CVE-2016-4315

Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to...

5.7 MediumPublic exploit

Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxy_ajaxprocessor.jsp.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.83%Down 7.0 points since Feb 4, 2022

What each source reports

NVD Score used 5.7

Record: CVE-2016-4315
CVSS 3.0: 5.7 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:N/A:P
Weakness: CWE-352
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-4315
Updated: 2026-11-02

EUVDEUVD-2016-5315 No score

Record: EUVD-2016-5315
Updated: 2026-11-03

GitHub AdvisoriesGHSA-grhv-p8rf-rc43 5.7

Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to...

Record: GHSA-grhv-p8rf-rc43
CVSS 3.0: 5.7 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-352
Updated: 2026-11-02

Affected products

wso2 carbon

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WSO2 Carbon 4.4.5 - Denial of Service / Cross-Site Request Forgery	2016-08-16

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-4315 is a medium vulnerability (CVSS 5.7) in Wso2 Carbon, published February 16, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. No source names a fixed version.