WaratekVRT Sign in

CVE-2016-4316 WSO2 Carbon

Affected softwareWSO2 Carbon
Severity6.1 Medium CVSS 3.0 2 scores
WeaknessCross-site scripting (CWE-79)
Published17 Feb 2017
Updated17 Jun 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.

Exploitation status

Working exploit published

A reviewed exploit catalogue lists ready-to-run exploit code for this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment no assessment published
  • Indexed PoC 1 indexed Published artifacts you can open, in Exploit-DB; first seen 2016-08-16.
  • EPSS 4.0% chance in 30 days
IndexArtifactStarsFirst seen
Exploit-DB WSO2 Carbon 4.4.5 - Persistent Cross-Site Scripting 2016-08-16

Waratek protection

Mitigation candidate

A kind of vulnerability Waratek's rules address, with exploit code published or exploitation reported. No rule exists and none is planned yet. The decision below says what we found to build a rule from.

  • Protection none
  • Action unverified
  • Review automated Inferred
  • Record active
Decided by The affected package being open source on Maven, so the fix can be read
Finding This CVE affects an open-source Java library published on Maven Central (Maven packages: org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui, org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui, org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui), so it is squarely in ARMR's territory and the source needed to understand the defect is public. That makes it a candidate for an ARMR patch rule. No rule exists and none is scheduled: the diff between the affected and fixed versions has not been read, and a closer look may find no hook point ARMR can act on.

CVSS

6.1 MEDIUM v3.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N NVD Primary published
CVSS 2.0 4.3 none AV:N/AC:M/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui 0 none 4.4.5
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui 0 none 4.4.5
org.wso2.carbon.commons:org.wso2.carbon.messageflows.ui 0 none 4.4.5

Products and versions

4 products, 4 version entries
SourceVendorProductSchemeAffected versions
osv org.wso2.carbon.commons org.wso2.carbon.messageflows.ui generic ≤ 4.4.5
osv org.wso2.carbon.commons org.wso2.carbon.ndatasource.ui generic ≤ 4.4.5
osv org.wso2.carbon.identity.framework org.wso2.carbon.identity.mgt.ui generic ≤ 4.4.5
nvd wso2 carbon generic 4.4.5

References

URLTags
https://web.archive.org/web/20201207111805/http://www.securityfocus.com/archive/1/539201/100/0/threaded WEB
https://www.exploit-db.com/exploits/40241 WEB
http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt WEB
http://packetstormsecurity.com/files/138331/WSO2-Carbon-4.4.5-Cross-Site-Scripting.html WEB
http://www.securityfocus.com/archive/1/539201/100/0/threaded
http://www.securityfocus.com/bid/92473 Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/40241/ Exploit, Third Party Advisory, VDB Entry

Timeline
Published2017-02-17By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.