CVE:CVE-2022-29548
CNNVD:CNNVD-202204-3932
WSO2 API Manager等都是美国WSO2公司的产品。WSO2 API Manager是一套API生命周期管理解决方案。WSO2 Dashboard Server是一款仪表板服务器。WSO2 Identity Server（IS）是一款身份认证服务器。
WSO2 多个产品存在安全漏洞，该漏洞源于输出编码不正确。攻击者利用此漏洞可以使浏览器重定向到恶意网站，在网页 UI 中进行更改，从浏览器中检索信息或以其他方式造成伤害。以下产品和版本受到影响：WSO2 API Manager : 2.2.0,2.5.0,2.6.0,3.0.0,3.1.0,3.2.0,4.0.0、WSO2 API Manager Analytics : 2.2.0,2.5.0,2.6.0、WSO2 API Microgateway : 2.2.0、WSO2 Data Analytics Server : 3.2.0、WSO2 Enterprise Integrator : 6.2.0,6.3.0,6.4.0,6.5.0,6.6.0、WSO2 IS as Key Manager : 5.5.0,5.6.0,5.7.0,5.9.0,5.10.0、WSO2 Identity Server : 5.5.0,5.6.0,5.7.0,5.9.0,5.10.0,5.11.0、WSO2 Identity Server Analytics : 5.5.0,5.6.0 和 WSO2 Micro Integrator : 1.0.0。
solution:Upgrade wso2 api_manager to a higher version than 2.2.0,2.5.0,2.6.0,3.0.0,3.1.0,3.2.0,4.0.0,and avoid the version 2.2.0,2.5.0,2.6.0,3.0.0,3.1.0,3.2.0,4.0.0; Upgrade wso2 api_manager_analytics to a higher version than 2.2.0,2.5.0,2.6.0,and avoid the version 2.2.0,2.5.0,2.6.0; Upgrade wso2 api_microgateway to a higher version than 2.2.0,and avoid the version 2.2.0; Upgrade wso2 data_analytics_server to a higher version than 3.2.0,and avoid the version 3.2.0; Upgrade wso2 enterprise_integrator to a higher version than 6.2.0,6.3.0,6.4.0,6.5.0,6.6.0,and avoid the version 6.2.0,6.3.0,6.4.0,6.5.0,6.6.0; Upgrade wso2 identity_server to a higher version than 5.5.0,5.6.0,5.7.0,5.9.0,5.10.0,5.11.0,and avoid the version 5.5.0,5.6.0,5.7.0,5.9.0,5.10.0,5.11.0; Upgrade wso2 identity_server_analytics to a higher version than 5.5.0,5.6.0,and avoid the version 5.5.0,5.6.0; Upgrade wso2 identity_server_as_key_manager to a higher version than 5.5.0,5.6.0,5.7.0,5.9.0,5.10.0,and avoid the version 5.5.0,5.6.0,5.7.0,5.9.0,5.10.0; Upgrade wso2 micro_integrator to a higher version than 1.0.0,and avoid the version 1.0.0