CVE-2019-6512

MEDIUM

WSO2 API Manager 2.6.0 - Server-Side Request Forgery via file:// Wrapper

Title source: llm

Description

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper.

References (3)

Core 3

Core References

Various Sources

https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6512

Vendor Advisory

https://wso2.com/security-patch-releases/api-manager

Third Party Advisory

https://www.excellium-services.com/cert-xlm-advisory

Scores

CVSS v3 4.1

EPSS 0.0112

EPSS Percentile 61.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Details

CWE

CWE-918

Status published

Products (1)

wso2/api_manager 2.6.0

Published May 14, 2019

Tracked Since Feb 18, 2026