CVE-2019-6512

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper.

Metrics

CVSS 3.0 4.1/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cds.thalesgroup.com/en/tcs-cert/CVE-2019-6512
https://wso2.com/security-patch-releases/api-managerVendor Advisory
https://www.excellium-services.com/cert-xlm-advisoryThird Party Advisory
https://wso2.com/security-patch-releases/api-managerVendor Advisory
https://www.excellium-services.com/cert-xlm-advisoryThird Party Advisory

Timeline

Published: May 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65135.4An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by CVE-2019-65144.8An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database an CVE-2019-65155.3An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user.CVE-2019-65165.8An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstat CVE-2019-65176.8BD FACSLyric Research Use Only, Windows 10 Professional Operating System, U.S. and Malaysian Releases, between November 2017 and November 20 CVE-2019-65187.5Moxa IKS and EDS store plaintext passwords, which may allow sensitive information to be read by someone with access to the device.CVE-2019-65199.8WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an CVE-2019-65207.5Moxa IKS and EDS does not properly check authority on server side, which results in a read-only user being able to perform arbitrary configu CVE-2019-65218.6WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain CVE-2019-65229.1Moxa IKS and EDS fails to properly check array bounds which may allow an attacker to read device memory on arbitrary addresses, and may allo CVE-2019-65239.8WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands.CVE-2019-65249.8Moxa IKS and EDS do not implement sufficient measures to prevent multiple failed authentication attempts, which may allow an attacker to dis