WSO2 Carbon vulnerabilities

3 CVEs affecting WSO2 Carbon, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-4316, published 2017-02-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-4314, published 2017-02-17. Medium severity, CVSS 4.9. EPSS: 12.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to…
CVE-2016-4316, published 2017-02-17. Medium severity, CVSS 6.1. EPSS: 4% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to…
CVE-2016-4315, published 2017-02-17. Medium severity, CVSS 5.7. EPSS: 2.8% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action…