VULNERABILITY INTELLIGENCE
CVE-2016-4311
CVSS score8.8 HIGH
EPSS probability3.38%
CISA KEVNot currently listed
Published2017-02-17
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request.
Weakness classification
- CWE-352: Cross-Site Request Forgery (CSRF)
Primary references
- cret@cert.org — Exploit, Third Party Advisory
- cret@cert.org — Exploit, Third Party Advisory, VDB Entry
- cret@cert.org
- cret@cert.org — Third Party Advisory, VDB Entry
- cret@cert.org — Exploit, Third Party Advisory, VDB Entry
- nvd@nist.gov — Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry