Saml2 Sso Authenticator Ui Bundle
Monthly
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to arbitrary internal or external network locations and to filesystem resources reachable from the WSO2 host. The vendor CVSS vector requires low-level privileges (PR:L), while the advisory text claims an unauthenticated actor can exploit the flaw, so the authentication barrier is unresolved and should be confirmed with WSO2. No public exploit identified at time of analysis, no CISA KEV entry is present in the supplied data, and the issue is prioritized for handling this week.
Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to arbitrary internal or external network locations and to filesystem resources reachable from the WSO2 host. The vendor CVSS vector requires low-level privileges (PR:L), while the advisory text claims an unauthenticated actor can exploit the flaw, so the authentication barrier is unresolved and should be confirmed with WSO2. No public exploit identified at time of analysis, no CISA KEV entry is present in the supplied data, and the issue is prioritized for handling this week.