Find a vulnerability

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

6 vulnerabilities found for WSO2 Carbon Identity User Store Configuration UI by WSO2

CVE-2024-4412 (GCVE-0-2024-4412)

Vulnerability from nvd – Published: 2026-10-19 16:59 – Updated: 2026-10-20 19:31

Title

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Summary

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Severity

2.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 19:31 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

WSO2 CNA under the mitre root

CNA scorecard B 89/100 over 68 records in the last 180 days details

References

5 references

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory
https://github.com/wso2-extensions/identity-gover…	patch
https://github.com/wso2/carbon-identity-framework…	patch
https://github.com/wso2/identity-apps/pull/6829	patch
https://github.com/wso2/product-apim/pull/13524	patch

Impacted products

11 products

Vendor	Product	Version
WSO2	WSO2 Enterprise Integrator	Unknown: 0 , < 6.6.0 (custom) Affected: 6.6.0 , < 6.6.0.205 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator::::::::
WSO2	WSO2 API Manager	Unknown: 0 , < 3.1.0 (custom) Affected: 3.1.0 , < 3.1.0.276 (custom) Affected: 3.2.0 , < 3.2.0.366 (custom) Affected: 3.2.1 , < 3.2.1.18 (custom) Affected: 4.0.0 , < 4.0.0.307 (custom) Affected: 4.1.0 , < 4.1.0.169 (custom) Affected: 4.2.0 , < 4.2.0.108 (custom) Affected: 4.3.0 , < 4.3.0.20 (custom) cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager::::::::
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.346 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
WSO2	WSO2 Identity Server	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.297 (custom) Affected: 5.11.0 , < 5.11.0.337 (custom) Affected: 6.0.0 , < 6.0.0.189 (custom) Affected: 6.1.0 , < 6.1.0.149 (custom) Affected: 7.0.0 , < 7.0.0.15 (custom) cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server::::::::
WSO2	WSO2 Identity Server as Key Manager	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.293 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager::::::::
WSO2	WSO2 Open Banking AM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.326 (custom) cpe:2.3:a:wso2:wso2_open_banking_am::::::::
WSO2	WSO2 Carbon Identity User Store Configuration UI	Affected: 5.14.127 , < 5.14.127.8 (custom) Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui::::::::
WSO2	WSO2 Carbon Identity User Store Configuration	Affected: 5.14.127 , < 5.14.127.8 (custom) Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration::::::::
WSO2	WSO2 Carbon Identity Recovery Management	Affected: 1.4.72 , < 1.4.72.66 (custom) Affected: 1.4.100 , < 1.4.100.6 (custom) Affected: 1.7.2 , < 1.7.2.2 (custom) Affected: 1.8.107 , < 1.8.107.1 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management::::::::
WSO2	WSO2 Carbon Identity Application Authentication Framework	Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework::::::::
WSO2	WSO2 Carbon Identity User Store	Affected: 1.0.190 , < 1.0.190.14 (custom) Affected: 1.2.3 , < 1.2.3.4 (custom) Affected: 1.2.23 , < 1.2.23.4 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4412",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T19:31:18.482516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T19:31:26.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.205",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.276",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.366",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.18",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.307",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.169",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.108",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.346",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.297",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.337",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.189",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.149",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.293",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.326",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
          "product": "WSO2 Carbon Identity User Store Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.8",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.266",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.6",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.253",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.178",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.81",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.12",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.user.store.configuration",
          "product": "WSO2 Carbon Identity User Store Configuration",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.8",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.266",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.6",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.253",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.178",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.81",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.12",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
          "product": "WSO2 Carbon Identity Recovery Management",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.72.66",
              "status": "affected",
              "version": "1.4.72",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.100.6",
              "status": "affected",
              "version": "1.4.100",
              "versionType": "custom"
            },
            {
              "lessThan": "1.7.2.2",
              "status": "affected",
              "version": "1.7.2",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.107.1",
              "status": "affected",
              "version": "1.8.107",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
          "product": "WSO2 Carbon Identity Application Authentication Framework",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
          "product": "WSO2 Carbon Identity User Store",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.0.190.14",
              "status": "affected",
              "version": "1.0.190",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.3.4",
              "status": "affected",
              "version": "1.2.3",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.23.4",
              "status": "affected",
              "version": "1.2.23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.0.205",
                  "versionStartIncluding": "6.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.0.276",
                  "versionStartIncluding": "3.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.0.366",
                  "versionStartIncluding": "3.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.1.18",
                  "versionStartIncluding": "3.2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.0.307",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.0.169",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.0.108",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0.20",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.346",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.297",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.0.337",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0.189",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.0.149",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.0.15",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.293",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.326",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.8",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.266",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.6",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.253",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.178",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.81",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.12",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.8",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.266",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.6",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.253",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.178",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.81",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.12",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.72.66",
                  "versionStartIncluding": "1.4.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.100.6",
                  "versionStartIncluding": "1.4.100",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.2.2",
                  "versionStartIncluding": "1.7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.8.107.1",
                  "versionStartIncluding": "1.8.107",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.190.14",
                  "versionStartIncluding": "1.0.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2.3.4",
                  "versionStartIncluding": "1.2.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2.23.4",
                  "versionStartIncluding": "1.2.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
            }
          ],
          "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-22",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-22 CAPEC-22: Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T16:59:05.004Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2-extensions/identity-governance/pull/848"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/carbon-identity-framework/pull/5895"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/identity-apps/pull/6829"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/product-apim/pull/13524"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2023-3098",
        "discovery": "INTERNAL"
      },
      "title": "Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-4412",
    "datePublished": "2026-10-19T16:59:05.004Z",
    "dateReserved": "2024-05-02T08:55:58.638Z",
    "dateUpdated": "2026-10-20T19:31:26.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13394 (GCVE-0-2025-13394)

Vulnerability from nvd – Published: 2026-08-06 07:33 – Updated: 2026-08-06 12:32

Title

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Summary

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 12:32 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

WSO2 CNA under the mitre root

CNA scorecard B 89/100 over 68 records in the last 180 days details

References

1 reference

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory

Impacted products

47 products

Vendor	Product	Version
WSO2	WSO2 Identity Server	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.381 (custom) Affected: 5.11.0 , < 5.11.0.428 (custom) Affected: 6.0.0 , < 6.0.0.255 (custom) Affected: 6.1.0 , < 6.1.0.256 (custom) Affected: 7.0.0 , < 7.0.0.133 (custom) Affected: 7.1.0 , < 7.1.0.41 (custom) Affected: 7.2.0 , < 7.2.0.3 (custom)
WSO2	WSO2 API Manager	Unknown: 0 , < 3.1.0 (custom) Affected: 3.1.0 , < 3.1.0.352 (custom) Affected: 3.2.0 , < 3.2.0.456 (custom) Affected: 3.2.1 , < 3.2.1.75 (custom) Affected: 4.0.0 , < 4.0.0.376 (custom) Affected: 4.1.0 , < 4.1.0.239 (custom) Affected: 4.2.0 , < 4.2.0.179 (custom) Affected: 4.3.0 , < 4.3.0.91 (custom) Affected: 4.4.0 , < 4.4.0.55 (custom) Affected: 4.5.0 , < 4.5.0.38 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.421 (custom)
WSO2	WSO2 Open Banking AM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.401 (custom)
WSO2	WSO2 Identity Server as Key Manager	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.372 (custom)
WSO2	WSO2 API Control Plane	Unknown: 0 , < 4.5.0 (custom) Affected: 4.5.0 , < 4.5.0.39 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Universal Gateway	Unknown: 0 , < 4.5.0 (custom) Affected: 4.5.0 , < 4.5.0.37 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Traffic Manager	Unknown: 0 , < 4.5.0 (custom) Affected: 4.5.0 , < 4.5.0.37 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Enterprise Integrator	Unknown: 0 , < 6.6.0 (custom) Affected: 6.6.0 , < 6.6.0.227 (custom)
WSO2	WSO2 Carbon Identity Entitlement UI	Affected: 5.17.5 , < 5.17.5.331 (custom) Affected: 5.18.187 , < 5.18.187.329 (custom) Affected: 5.23.8 , < 5.23.8.210 (custom) Affected: 5.25.92 , < 5.25.92.166 (custom) Affected: 7.0.78 , < 7.0.78.157 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Identity Management UI1	Affected: 5.17.5 , < 5.17.5.330 (custom) Affected: 5.17.5 , < 5.17.5.331 (custom) Affected: 5.17.118 , < 5.17.118.22 (custom) Affected: 5.18.187 , < 5.18.187.328 (custom) Affected: 5.18.187 , < 5.18.187.329 (custom) Affected: 5.18.248 , < 5.18.248.31 (custom) Affected: 5.23.8 , < 5.23.8.210 (custom) Affected: 5.24.8 , < 5.24.8.26 (custom) Affected: 5.25.92 , < 5.25.92.166 (custom) Affected: 5.25.705 , < 5.25.705.21 (custom) Affected: 5.25.713 , < 5.25.713.10 (custom) Affected: 5.25.724 , < 5.25.724.5 (custom) Affected: 5.25.736 , < 5.25.736.1 (custom) Affected: 7.0.78 , < 7.0.78.157 (custom) Affected: 7.8.23 , < 7.8.23.67 (custom) Affected: 7.8.586 , < 7.8.586.7 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Identity User Store Configuration UI	Affected: 5.14.127 , < 5.14.127.13 (custom) Affected: 5.17.5 , < 5.17.5.330 (custom) Affected: 5.17.5 , < 5.17.5.331 (custom) Affected: 5.17.118 , < 5.17.118.22 (custom) Affected: 5.18.187 , < 5.18.187.328 (custom) Affected: 5.18.187 , < 5.18.187.329 (custom) Affected: 5.18.248 , < 5.18.248.31 (custom) Affected: 5.23.8 , < 5.23.8.210 (custom) Affected: 5.24.8 , < 5.24.8.26 (custom) Affected: 5.25.92 , < 5.25.92.166 (custom) Affected: 5.25.705 , < 5.25.705.21 (custom) Affected: 5.25.713 , < 5.25.713.10 (custom) Affected: 5.25.724 , < 5.25.724.5 (custom) Affected: 5.25.736 , < 5.25.736.1 (custom) Affected: 7.0.78 , < 7.0.78.157 (custom) Affected: 7.8.23 , < 7.8.23.67 (custom) Affected: 7.8.586 , < 7.8.586.7 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Profiles UI	Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Affected: 4.8.43 , < 4.8.43.4 (custom) Affected: 4.8.50 , < 4.8.50.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Properties UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.43 , < 4.8.43.4 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Affected: 4.8.50 , < 4.8.50.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Resources UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.43 , < 4.8.43.4 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Affected: 4.8.50 , < 4.8.50.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Search UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Stratos User Interface For Tenant CRUD Operations	Affected: 4.8.1 , < 4.8.1.6 (custom) Affected: 4.8.7 , < 4.8.7.3 (custom) Affected: 4.9.8 , < 4.9.8.7 (custom) Affected: 4.9.10 , < 4.9.10.7 (custom) Affected: 4.9.10 , < 4.9.10.8 (custom) Affected: 4.9.20 , < 4.9.20.5 (custom) Affected: 4.9.27 , < 4.9.27.1 (custom) Affected: 4.9.31 , < 4.9.31.1 (custom) Affected: 4.9.34 , < 4.9.34.1 (custom) Affected: 4.9.42 , < 4.9.42.1 (custom) Affected: 4.11.0 , < 4.11.0.7 (custom) Affected: 4.11.19 , < 4.11.19.4 (custom) Affected: 4.11.34 , < 4.11.34.3 (custom) Affected: 4.11.45 , < 4.11.45.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Stratos SSO Redirector UI Component	Affected: 4.8.1 , < 4.8.1.6 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Email Verification UI	Affected: 4.7.19 , < 4.7.19.14 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Event Simulator UI	Affected: 2.2.11 , < 2.2.11.1 (custom) Affected: 2.2.14 , < 2.2.14.11 (custom) Affected: 2.2.14 , < 2.2.14.12 (custom) Affected: 2.2.17 , < 2.2.17.5 (custom) Affected: 2.3.1 , < 2.3.1.4 (custom) Affected: 2.3.5 , < 2.3.5.6 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Execution Manager UI	Affected: 5.2.24 , < 5.2.24.10 (custom) Affected: 5.2.26 , < 5.2.26.22 (custom) Affected: 5.2.34 , < 5.2.34.12 (custom) Affected: 5.2.41 , < 5.2.41.7 (custom) Affected: 5.2.57 , < 5.2.57.10 (custom) Affected: 5.3.5 , < 5.3.5.9 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance Custom Lifecycle Checklist UI	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance Generic Artifact User Interface	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.33 , < 4.8.33.4 (custom) Affected: 4.8.34 , < 4.8.34.5 (custom) Affected: 4.8.37 , < 4.8.37.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance Life Cycles User Interface	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance WSDL Tool UI	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.33 , < 4.8.33.4 (custom) Affected: 4.8.34 , < 4.8.34.5 (custom) Affected: 4.8.37 , < 4.8.37.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon New Data Sources UI	Affected: 4.7.19 , < 4.7.19.13 (custom) Affected: 4.7.24 , < 4.7.24.5 (custom) Affected: 4.7.32 , < 4.7.32.10 (custom) Affected: 4.7.35 , < 4.7.35.13 (custom) Affected: 4.7.49 , < 4.7.49.7 (custom) Affected: 4.7.52 , < 4.7.52.5 (custom) Affected: 4.9.2 , < 4.9.2.8 (custom) Affected: 4.9.11 , < 4.9.11.2 (custom) Affected: 4.9.18 , < 4.9.18.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Info UI2	Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Relations UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Indexing	Affected: 4.7 , < 4.7.24 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Security UI	Affected: 5.14 , < 5.14.127 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Component Andes Event UI	Affected: 3.3.12 , < 3.3.12.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Component Andes UI1	Affected: 3.3.12 , < 3.3.12.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon HL7 Business Messaging Store UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Endpoint Editor UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Publish Event Mediator Configuration UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Eventing UI	Affected: 4.7.19 , < 4.7.19.13 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon HumanTask UI	Affected: 4.5.27 , < 4.5.27.10 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Logging UI	Affected: 4.7.19 , < 4.7.19.13 (custom) Affected: 4.7.24 , < 4.7.24.5 (custom) Affected: 4.7.32 , < 4.7.32.10 (custom) Affected: 4.7.52 , < 4.7.52.5 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Template Editor UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Command Mediator UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Rule Mediator UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Throttle Mediator UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Tasks Core	Affected: 4.7.19 , < 4.7.19.13 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Rest API Admin UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Sequence Editor UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Task UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance	Affected: 4.8.37 , < 4.8.37.4 (custom) Unaffected: x , ≤ * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T12:32:20.578575Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T12:32:29.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.381",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.428",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.255",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.256",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.133",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.41",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.2.0.3",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.352",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.456",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.75",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.376",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.239",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.179",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.91",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.55",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.38",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.421",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.401",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.372",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.39",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.37",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.37",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.227",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.entitlement.ui",
          "product": "WSO2 Carbon Identity Entitlement UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.17.5.331",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.329",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.210",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.166",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.157",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui",
          "product": "WSO2 Carbon Identity Management UI1",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.17.5.330",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.331",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.22",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.328",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.329",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.31",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.210",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.26",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.166",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.21",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.10",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.5",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.736.1",
              "status": "affected",
              "version": "5.25.736",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.157",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.67",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.586.7",
              "status": "affected",
              "version": "7.8.586",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
          "product": "WSO2 Carbon Identity User Store Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.13",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.330",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.331",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.22",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.328",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.329",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.31",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.210",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.26",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.166",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.21",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.10",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.5",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.736.1",
              "status": "affected",
              "version": "5.25.736",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.157",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.67",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.586.7",
              "status": "affected",
              "version": "7.8.586",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.profiles.ui",
          "product": "WSO2 Carbon Registry Profiles UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.4",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.3",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.properties.ui",
          "product": "WSO2 Carbon Registry Properties UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.4",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.3",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.resource.ui",
          "product": "WSO2 Carbon Registry Resources UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.4",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.3",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.search.ui",
          "product": "WSO2 Carbon Registry Search UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.tenant.mgt.ui",
          "product": "WSO2 Stratos User Interface For Tenant CRUD Operations",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.1.6",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.7.3",
              "status": "affected",
              "version": "4.8.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.8.7",
              "status": "affected",
              "version": "4.9.8",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.10.7",
              "status": "affected",
              "version": "4.9.10",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.10.8",
              "status": "affected",
              "version": "4.9.10",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.20.5",
              "status": "affected",
              "version": "4.9.20",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.1",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.31.1",
              "status": "affected",
              "version": "4.9.31",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.34.1",
              "status": "affected",
              "version": "4.9.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.42.1",
              "status": "affected",
              "version": "4.9.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.0.7",
              "status": "affected",
              "version": "4.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.19.4",
              "status": "affected",
              "version": "4.11.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.34.3",
              "status": "affected",
              "version": "4.11.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.45.1",
              "status": "affected",
              "version": "4.11.45",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.multitenancy:org.wso2.carbon.tenant.sso.redirector.ui",
          "product": "WSO2 Stratos SSO Redirector UI Component",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.1.6",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.email.verification.ui",
          "product": "WSO2 Carbon Email Verification UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.14",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.event.simulator.ui",
          "product": "WSO2 Carbon Event Simulator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.2.11.1",
              "status": "affected",
              "version": "2.2.11",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.14.11",
              "status": "affected",
              "version": "2.2.14",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.14.12",
              "status": "affected",
              "version": "2.2.14",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.17.5",
              "status": "affected",
              "version": "2.2.17",
              "versionType": "custom"
            },
            {
              "lessThan": "2.3.1.4",
              "status": "affected",
              "version": "2.3.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2.3.5.6",
              "status": "affected",
              "version": "2.3.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.template.manager.ui",
          "product": "WSO2 Carbon Execution Manager UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.24.10",
              "status": "affected",
              "version": "5.2.24",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.26.22",
              "status": "affected",
              "version": "5.2.26",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.34.12",
              "status": "affected",
              "version": "5.2.34",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.41.7",
              "status": "affected",
              "version": "5.2.41",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.57.10",
              "status": "affected",
              "version": "5.2.57",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.5.9",
              "status": "affected",
              "version": "5.3.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.custom.lifecycles.checklist.ui",
          "product": "WSO2 Carbon Governance Custom Lifecycle Checklist UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.generic.ui",
          "product": "WSO2 Carbon Governance Generic Artifact User Interface",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.33.4",
              "status": "affected",
              "version": "4.8.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.34.5",
              "status": "affected",
              "version": "4.8.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.37.4",
              "status": "affected",
              "version": "4.8.37",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.lcm.ui",
          "product": "WSO2 Carbon Governance Life Cycles User Interface",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.governance.wsdltool.ui",
          "product": "WSO2 Carbon Governance WSDL Tool UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.33.4",
              "status": "affected",
              "version": "4.8.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.34.5",
              "status": "affected",
              "version": "4.8.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.37.4",
              "status": "affected",
              "version": "4.8.37",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui",
          "product": "WSO2 Carbon New Data Sources UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.24.5",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.10",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.13",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.49.7",
              "status": "affected",
              "version": "4.7.49",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.52.5",
              "status": "affected",
              "version": "4.7.52",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.2.8",
              "status": "affected",
              "version": "4.9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.11.2",
              "status": "affected",
              "version": "4.9.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.18.1",
              "status": "affected",
              "version": "4.9.18",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.info.ui",
          "product": "WSO2 Carbon Registry Info UI2",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.relations.ui",
          "product": "WSO2 Carbon Registry Relations UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.registry:org.wso2.carbon.registry.indexing",
          "product": "WSO2 Carbon Registry Indexing",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24",
              "status": "affected",
              "version": "4.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.security.mgt.ui",
          "product": "WSO2 Carbon Security UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127",
              "status": "affected",
              "version": "5.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.messaging:org.wso2.carbon.andes.event.ui",
          "product": "WSO2 Carbon Component Andes Event UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.3.12.3",
              "status": "affected",
              "version": "3.3.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.messaging:org.wso2.carbon.andes.ui",
          "product": "WSO2 Carbon Component Andes UI1",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.3.12.3",
              "status": "affected",
              "version": "3.3.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.mediation:org.wso2.carbon.business.messaging.hl7.store.ui",
          "product": "WSO2 Carbon HL7 Business Messaging Store UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbonorg.wso2.carbon.endpoint.ui",
          "product": "WSO2 Carbon Endpoint Editor UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.mediationorg.wso2.carbon.event.sink.config.ui",
          "product": "WSO2 Carbon Publish Event Mediator Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.commons:org.wso2.carbon.event.ui",
          "product": "WSO2 Carbon Eventing UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.business-process:org.wso2.carbon.humantask.ui",
          "product": "WSO2 Carbon HumanTask UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.27.10",
              "status": "affected",
              "version": "4.5.27",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.logging.admin.ui",
          "product": "WSO2 Carbon Logging UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.24.5",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.10",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.52.5",
              "status": "affected",
              "version": "4.7.52",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.templates.ui",
          "product": "WSO2 Carbon Template Editor UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.mediator.command.ui",
          "product": "WSO2 Carbon Command Mediator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.mediator.rule.ui",
          "product": "WSO2 Carbon Rule Mediator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.mediator.throttle.ui",
          "product": "WSO2 Carbon Throttle Mediator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.ntask.core",
          "product": "WSO2 Carbon Tasks Core",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.rest.api.ui",
          "product": "WSO2 Carbon Rest API Admin UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.sequences.ui",
          "product": "WSO2 Carbon Sequence Editor UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.task.ui",
          "product": "WSO2 Carbon Task UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.api",
          "product": "WSO2 Carbon Governance",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.37.4",
              "status": "affected",
              "version": "4.8.37",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user\u0027s browser into unknowingly executing unintended actions.\n\nAn attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2\u0027s security guidelines."
            }
          ],
          "value": "The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user\u0027s browser into unknowingly executing unintended actions.\n\nAn attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2\u0027s security guidelines."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 CAPEC-234: Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T07:33:17.645Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2025-4800",
        "discovery": "INTERNAL"
      },
      "title": "Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2025-13394",
    "datePublished": "2026-08-06T07:33:17.645Z",
    "dateReserved": "2025-11-19T06:17:35.259Z",
    "dateUpdated": "2026-08-06T12:32:29.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-8008 (GCVE-0-2024-8008)

Vulnerability from nvd – Published: 2025-06-02 16:48 – Updated: 2026-10-16 11:39

Title

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Summary

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

Severity

5.2 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-02 17:05 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

WSO2 CNA under the mitre root

CNA scorecard B 89/100 over 68 records in the last 180 days details

References

1 reference

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory

Impacted products

10 products

Vendor	Product	Version
WSO2	WSO2 Enterprise Integrator	Unknown: 0 , < 6.6.0 (custom) Affected: 6.6.0 , < 6.6.0.211 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator::::::::
WSO2	WSO2 API Manager	Unknown: 0 , < 3.1.0 (custom) Affected: 3.1.0 , < 3.1.0.305 (custom) Affected: 3.2.0 , < 3.2.0.396 (custom) Affected: 3.2.1 , < 3.2.1.28 (custom) Affected: 4.0.0 , < 4.0.0.313 (custom) Affected: 4.1.0 , < 4.1.0.182 (custom) Affected: 4.2.0 , < 4.2.0.121 (custom) Affected: 4.3.0 , < 4.3.0.32 (custom) Affected: 4.4.0 , < 4.4.0.1 (custom) Affected: 4.5.0 , < 4.5.0.16 (custom) cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager::::::::
WSO2	WSO2 Identity Server as Key Manager	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.321 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager::::::::
WSO2	WSO2 Identity Server	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.328 (custom) Affected: 5.11.0 , < 5.11.0.374 (custom) Affected: 6.0.0 , < 6.0.0.216 (custom) Affected: 6.1.0 , < 6.1.0.201 (custom) Affected: 7.0.0 , < 7.0.0.69 (custom) cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server::::::::
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.374 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
WSO2	WSO2 Open Banking AM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.354 (custom) cpe:2.3:a:wso2:wso2_open_banking_am::::::::
WSO2	WSO2 Traffic Manager	Affected: 4.5.0 , < 4.5.0.16 (custom) cpe:2.3:a:wso2:wso2_traffic_manager::::::::
WSO2	WSO2 API Control Plane	Affected: 4.5.0 , < 4.5.0.17 (custom) cpe:2.3:a:wso2:wso2_api_control_plane::::::::
WSO2	WSO2 Universal Gateway	Affected: 4.5.0 , < 4.5.0.16 (custom) cpe:2.3:a:wso2:wso2_universal_gateway::::::::
WSO2	WSO2 Carbon Identity User Store Configuration UI	Affected: 5.14.127 , < 5.14.127.9 (custom) Affected: 5.17.5 , < 5.17.5.289 (custom) Affected: 5.17.118 , < 5.17.118.10 (custom) Affected: 5.18.187 , < 5.18.187.276 (custom) Affected: 5.18.248 , < 5.18.248.22 (custom) Affected: 5.23.8 , < 5.23.8.193 (custom) Affected: 5.24.8 , < 5.24.8.11 (custom) Affected: 5.25.92 , < 5.25.92.104 (custom) Affected: 5.25.705 , < 5.25.705.10 (custom) Affected: 5.25.713 , < 5.25.713.1 (custom) Affected: 5.25.724 , < 5.25.724.1 (custom) Affected: 7.0.78 , < 7.0.78.46 (custom) Unaffected: 5.25.725 , ≤ 5.25.* (custom) Unaffected: 5.27.0 , ≤ 5.27.* (custom) Unaffected: 7.5.12 , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-02T17:05:11.526830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-02T17:05:24.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.211",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.305",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.396",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.28",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.313",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.182",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.121",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.32",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.1",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.16",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.321",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.328",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.374",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.216",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.201",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.69",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.374",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.354",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.16",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.17",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.16",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
          "product": "WSO2 Carbon Identity User Store Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.9",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.289",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.10",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.276",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.22",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.193",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.11",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.104",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.10",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.1",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.1",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.46",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.25.*",
              "status": "unaffected",
              "version": "5.25.725",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.27.*",
              "status": "unaffected",
              "version": "5.27.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.5.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.0.211",
                  "versionStartIncluding": "6.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.0.305",
                  "versionStartIncluding": "3.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.0.396",
                  "versionStartIncluding": "3.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.1.28",
                  "versionStartIncluding": "3.2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.0.313",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.0.182",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.0.121",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0.32",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.0.1",
                  "versionStartIncluding": "4.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.16",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.321",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.328",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.0.374",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0.216",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.0.201",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.0.69",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.374",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.354",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.16",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.17",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.16",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.9",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.289",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.10",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.276",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.22",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.193",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.11",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.104",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.10",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.713.1",
                  "versionStartIncluding": "5.25.713",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.724.1",
                  "versionStartIncluding": "5.25.724",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.46",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.25.*",
                  "versionStartIncluding": "5.25.725",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.27.*",
                  "versionStartIncluding": "5.27.0",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "*",
                  "versionStartIncluding": "7.5.12",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.\u003cbr\u003e\u003cbr\u003eThis vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible."
            }
          ],
          "value": "A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.\n\nThis vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T11:39:49.442Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2024-3178",
        "discovery": "INTERNAL"
      },
      "title": "Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-8008",
    "datePublished": "2025-06-02T16:48:12.479Z",
    "dateReserved": "2024-08-20T11:32:44.245Z",
    "dateUpdated": "2026-10-16T11:39:49.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-4412 (GCVE-0-2024-4412)

Vulnerability from cvelistv5 – Published: 2026-10-19 16:59 – Updated: 2026-10-20 19:31

Title

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Summary

Severity

2.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-20 19:31 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

WSO2 CNA under the mitre root

CNA scorecard B 89/100 over 68 records in the last 180 days details

References

5 references

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory
https://github.com/wso2-extensions/identity-gover…	patch
https://github.com/wso2/carbon-identity-framework…	patch
https://github.com/wso2/identity-apps/pull/6829	patch
https://github.com/wso2/product-apim/pull/13524	patch

Impacted products

11 products

Vendor	Product	Version
WSO2	WSO2 Enterprise Integrator	Unknown: 0 , < 6.6.0 (custom) Affected: 6.6.0 , < 6.6.0.205 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator::::::::
WSO2	WSO2 API Manager	Unknown: 0 , < 3.1.0 (custom) Affected: 3.1.0 , < 3.1.0.276 (custom) Affected: 3.2.0 , < 3.2.0.366 (custom) Affected: 3.2.1 , < 3.2.1.18 (custom) Affected: 4.0.0 , < 4.0.0.307 (custom) Affected: 4.1.0 , < 4.1.0.169 (custom) Affected: 4.2.0 , < 4.2.0.108 (custom) Affected: 4.3.0 , < 4.3.0.20 (custom) cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager::::::::
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.346 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
WSO2	WSO2 Identity Server	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.297 (custom) Affected: 5.11.0 , < 5.11.0.337 (custom) Affected: 6.0.0 , < 6.0.0.189 (custom) Affected: 6.1.0 , < 6.1.0.149 (custom) Affected: 7.0.0 , < 7.0.0.15 (custom) cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server::::::::
WSO2	WSO2 Identity Server as Key Manager	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.293 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager::::::::
WSO2	WSO2 Open Banking AM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.326 (custom) cpe:2.3:a:wso2:wso2_open_banking_am::::::::
WSO2	WSO2 Carbon Identity User Store Configuration UI	Affected: 5.14.127 , < 5.14.127.8 (custom) Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui::::::::
WSO2	WSO2 Carbon Identity User Store Configuration	Affected: 5.14.127 , < 5.14.127.8 (custom) Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration::::::::
WSO2	WSO2 Carbon Identity Recovery Management	Affected: 1.4.72 , < 1.4.72.66 (custom) Affected: 1.4.100 , < 1.4.100.6 (custom) Affected: 1.7.2 , < 1.7.2.2 (custom) Affected: 1.8.107 , < 1.8.107.1 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management::::::::
WSO2	WSO2 Carbon Identity Application Authentication Framework	Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework::::::::
WSO2	WSO2 Carbon Identity User Store	Affected: 1.0.190 , < 1.0.190.14 (custom) Affected: 1.2.3 , < 1.2.3.4 (custom) Affected: 1.2.23 , < 1.2.23.4 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4412",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-20T19:31:18.482516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-20T19:31:26.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.205",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.276",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.366",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.18",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.307",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.169",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.108",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.346",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.297",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.337",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.189",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.149",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.293",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.326",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
          "product": "WSO2 Carbon Identity User Store Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.8",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.266",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.6",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.253",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.178",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.81",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.12",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.user.store.configuration",
          "product": "WSO2 Carbon Identity User Store Configuration",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.8",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.266",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.6",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.253",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.178",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.81",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.12",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
          "product": "WSO2 Carbon Identity Recovery Management",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.72.66",
              "status": "affected",
              "version": "1.4.72",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.100.6",
              "status": "affected",
              "version": "1.4.100",
              "versionType": "custom"
            },
            {
              "lessThan": "1.7.2.2",
              "status": "affected",
              "version": "1.7.2",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.107.1",
              "status": "affected",
              "version": "1.8.107",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
          "product": "WSO2 Carbon Identity Application Authentication Framework",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
          "product": "WSO2 Carbon Identity User Store",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.0.190.14",
              "status": "affected",
              "version": "1.0.190",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.3.4",
              "status": "affected",
              "version": "1.2.3",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.23.4",
              "status": "affected",
              "version": "1.2.23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.0.205",
                  "versionStartIncluding": "6.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.0.276",
                  "versionStartIncluding": "3.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.0.366",
                  "versionStartIncluding": "3.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.1.18",
                  "versionStartIncluding": "3.2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.0.307",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.0.169",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.0.108",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0.20",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.346",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.297",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.0.337",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0.189",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.0.149",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.0.15",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.293",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.326",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.8",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.266",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.6",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.253",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.178",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.81",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.12",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.8",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.266",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.6",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.253",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.178",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.81",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.12",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.72.66",
                  "versionStartIncluding": "1.4.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.100.6",
                  "versionStartIncluding": "1.4.100",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.2.2",
                  "versionStartIncluding": "1.7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.8.107.1",
                  "versionStartIncluding": "1.8.107",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.190.14",
                  "versionStartIncluding": "1.0.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2.3.4",
                  "versionStartIncluding": "1.2.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2.23.4",
                  "versionStartIncluding": "1.2.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
            }
          ],
          "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-22",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-22 CAPEC-22: Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T16:59:05.004Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2-extensions/identity-governance/pull/848"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/carbon-identity-framework/pull/5895"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/identity-apps/pull/6829"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/product-apim/pull/13524"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2023-3098",
        "discovery": "INTERNAL"
      },
      "title": "Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-4412",
    "datePublished": "2026-10-19T16:59:05.004Z",
    "dateReserved": "2024-05-02T08:55:58.638Z",
    "dateUpdated": "2026-10-20T19:31:26.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-13394 (GCVE-0-2025-13394)

Vulnerability from cvelistv5 – Published: 2026-08-06 07:33 – Updated: 2026-08-06 12:32

Title

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Summary

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-06 12:32 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

WSO2 CNA under the mitre root

CNA scorecard B 89/100 over 68 records in the last 180 days details

References

1 reference

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory

Impacted products

47 products

Vendor	Product	Version
WSO2	WSO2 Identity Server	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.381 (custom) Affected: 5.11.0 , < 5.11.0.428 (custom) Affected: 6.0.0 , < 6.0.0.255 (custom) Affected: 6.1.0 , < 6.1.0.256 (custom) Affected: 7.0.0 , < 7.0.0.133 (custom) Affected: 7.1.0 , < 7.1.0.41 (custom) Affected: 7.2.0 , < 7.2.0.3 (custom)
WSO2	WSO2 API Manager	Unknown: 0 , < 3.1.0 (custom) Affected: 3.1.0 , < 3.1.0.352 (custom) Affected: 3.2.0 , < 3.2.0.456 (custom) Affected: 3.2.1 , < 3.2.1.75 (custom) Affected: 4.0.0 , < 4.0.0.376 (custom) Affected: 4.1.0 , < 4.1.0.239 (custom) Affected: 4.2.0 , < 4.2.0.179 (custom) Affected: 4.3.0 , < 4.3.0.91 (custom) Affected: 4.4.0 , < 4.4.0.55 (custom) Affected: 4.5.0 , < 4.5.0.38 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.421 (custom)
WSO2	WSO2 Open Banking AM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.401 (custom)
WSO2	WSO2 Identity Server as Key Manager	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.372 (custom)
WSO2	WSO2 API Control Plane	Unknown: 0 , < 4.5.0 (custom) Affected: 4.5.0 , < 4.5.0.39 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Universal Gateway	Unknown: 0 , < 4.5.0 (custom) Affected: 4.5.0 , < 4.5.0.37 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Traffic Manager	Unknown: 0 , < 4.5.0 (custom) Affected: 4.5.0 , < 4.5.0.37 (custom) Affected: 4.6.0 , < 4.6.0.3 (custom)
WSO2	WSO2 Enterprise Integrator	Unknown: 0 , < 6.6.0 (custom) Affected: 6.6.0 , < 6.6.0.227 (custom)
WSO2	WSO2 Carbon Identity Entitlement UI	Affected: 5.17.5 , < 5.17.5.331 (custom) Affected: 5.18.187 , < 5.18.187.329 (custom) Affected: 5.23.8 , < 5.23.8.210 (custom) Affected: 5.25.92 , < 5.25.92.166 (custom) Affected: 7.0.78 , < 7.0.78.157 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Identity Management UI1	Affected: 5.17.5 , < 5.17.5.330 (custom) Affected: 5.17.5 , < 5.17.5.331 (custom) Affected: 5.17.118 , < 5.17.118.22 (custom) Affected: 5.18.187 , < 5.18.187.328 (custom) Affected: 5.18.187 , < 5.18.187.329 (custom) Affected: 5.18.248 , < 5.18.248.31 (custom) Affected: 5.23.8 , < 5.23.8.210 (custom) Affected: 5.24.8 , < 5.24.8.26 (custom) Affected: 5.25.92 , < 5.25.92.166 (custom) Affected: 5.25.705 , < 5.25.705.21 (custom) Affected: 5.25.713 , < 5.25.713.10 (custom) Affected: 5.25.724 , < 5.25.724.5 (custom) Affected: 5.25.736 , < 5.25.736.1 (custom) Affected: 7.0.78 , < 7.0.78.157 (custom) Affected: 7.8.23 , < 7.8.23.67 (custom) Affected: 7.8.586 , < 7.8.586.7 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Identity User Store Configuration UI	Affected: 5.14.127 , < 5.14.127.13 (custom) Affected: 5.17.5 , < 5.17.5.330 (custom) Affected: 5.17.5 , < 5.17.5.331 (custom) Affected: 5.17.118 , < 5.17.118.22 (custom) Affected: 5.18.187 , < 5.18.187.328 (custom) Affected: 5.18.187 , < 5.18.187.329 (custom) Affected: 5.18.248 , < 5.18.248.31 (custom) Affected: 5.23.8 , < 5.23.8.210 (custom) Affected: 5.24.8 , < 5.24.8.26 (custom) Affected: 5.25.92 , < 5.25.92.166 (custom) Affected: 5.25.705 , < 5.25.705.21 (custom) Affected: 5.25.713 , < 5.25.713.10 (custom) Affected: 5.25.724 , < 5.25.724.5 (custom) Affected: 5.25.736 , < 5.25.736.1 (custom) Affected: 7.0.78 , < 7.0.78.157 (custom) Affected: 7.8.23 , < 7.8.23.67 (custom) Affected: 7.8.586 , < 7.8.586.7 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Profiles UI	Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Affected: 4.8.43 , < 4.8.43.4 (custom) Affected: 4.8.50 , < 4.8.50.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Properties UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.43 , < 4.8.43.4 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Affected: 4.8.50 , < 4.8.50.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Resources UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.43 , < 4.8.43.4 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Affected: 4.8.50 , < 4.8.50.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Search UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.32 , < 4.7.32.18 (custom) Affected: 4.7.33 , < 4.7.33.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.9 , < 4.8.9.16 (custom) Affected: 4.8.12 , < 4.8.12.8 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.24 , < 4.8.24.6 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Stratos User Interface For Tenant CRUD Operations	Affected: 4.8.1 , < 4.8.1.6 (custom) Affected: 4.8.7 , < 4.8.7.3 (custom) Affected: 4.9.8 , < 4.9.8.7 (custom) Affected: 4.9.10 , < 4.9.10.7 (custom) Affected: 4.9.10 , < 4.9.10.8 (custom) Affected: 4.9.20 , < 4.9.20.5 (custom) Affected: 4.9.27 , < 4.9.27.1 (custom) Affected: 4.9.31 , < 4.9.31.1 (custom) Affected: 4.9.34 , < 4.9.34.1 (custom) Affected: 4.9.42 , < 4.9.42.1 (custom) Affected: 4.11.0 , < 4.11.0.7 (custom) Affected: 4.11.19 , < 4.11.19.4 (custom) Affected: 4.11.34 , < 4.11.34.3 (custom) Affected: 4.11.45 , < 4.11.45.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Stratos SSO Redirector UI Component	Affected: 4.8.1 , < 4.8.1.6 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Email Verification UI	Affected: 4.7.19 , < 4.7.19.14 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Event Simulator UI	Affected: 2.2.11 , < 2.2.11.1 (custom) Affected: 2.2.14 , < 2.2.14.11 (custom) Affected: 2.2.14 , < 2.2.14.12 (custom) Affected: 2.2.17 , < 2.2.17.5 (custom) Affected: 2.3.1 , < 2.3.1.4 (custom) Affected: 2.3.5 , < 2.3.5.6 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Execution Manager UI	Affected: 5.2.24 , < 5.2.24.10 (custom) Affected: 5.2.26 , < 5.2.26.22 (custom) Affected: 5.2.34 , < 5.2.34.12 (custom) Affected: 5.2.41 , < 5.2.41.7 (custom) Affected: 5.2.57 , < 5.2.57.10 (custom) Affected: 5.3.5 , < 5.3.5.9 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance Custom Lifecycle Checklist UI	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance Generic Artifact User Interface	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.33 , < 4.8.33.4 (custom) Affected: 4.8.34 , < 4.8.34.5 (custom) Affected: 4.8.37 , < 4.8.37.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance Life Cycles User Interface	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance WSDL Tool UI	Affected: 4.8.14 , < 4.8.14.4 (custom) Affected: 4.8.19 , < 4.8.19.8 (custom) Affected: 4.8.21 , < 4.8.21.10 (custom) Affected: 4.8.28 , < 4.8.28.4 (custom) Affected: 4.8.30 , < 4.8.30.6 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.33 , < 4.8.33.4 (custom) Affected: 4.8.34 , < 4.8.34.5 (custom) Affected: 4.8.37 , < 4.8.37.4 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon New Data Sources UI	Affected: 4.7.19 , < 4.7.19.13 (custom) Affected: 4.7.24 , < 4.7.24.5 (custom) Affected: 4.7.32 , < 4.7.32.10 (custom) Affected: 4.7.35 , < 4.7.35.13 (custom) Affected: 4.7.49 , < 4.7.49.7 (custom) Affected: 4.7.52 , < 4.7.52.5 (custom) Affected: 4.9.2 , < 4.9.2.8 (custom) Affected: 4.9.11 , < 4.9.11.2 (custom) Affected: 4.9.18 , < 4.9.18.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Info UI2	Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Relations UI	Affected: 4.7.24 , < 4.7.24.11 (custom) Affected: 4.7.32 , < 4.7.32.16 (custom) Affected: 4.7.35 , < 4.7.35.15 (custom) Affected: 4.7.39 , < 4.7.39.12 (custom) Affected: 4.7.51 , < 4.7.51.8 (custom) Affected: 4.8.3 , < 4.8.3.10 (custom) Affected: 4.8.13 , < 4.8.13.9 (custom) Affected: 4.8.32 , < 4.8.32.4 (custom) Affected: 4.8.36 , < 4.8.36.2 (custom) Affected: 4.8.43 , < 4.8.43.2 (custom) Affected: 4.8.50 , < 4.8.50.1 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Registry Indexing	Affected: 4.7 , < 4.7.24 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Security UI	Affected: 5.14 , < 5.14.127 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Component Andes Event UI	Affected: 3.3.12 , < 3.3.12.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Component Andes UI1	Affected: 3.3.12 , < 3.3.12.3 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon HL7 Business Messaging Store UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Endpoint Editor UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Publish Event Mediator Configuration UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Eventing UI	Affected: 4.7.19 , < 4.7.19.13 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon HumanTask UI	Affected: 4.5.27 , < 4.5.27.10 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Logging UI	Affected: 4.7.19 , < 4.7.19.13 (custom) Affected: 4.7.24 , < 4.7.24.5 (custom) Affected: 4.7.32 , < 4.7.32.10 (custom) Affected: 4.7.52 , < 4.7.52.5 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Template Editor UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Command Mediator UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Rule Mediator UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Throttle Mediator UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Tasks Core	Affected: 4.7.19 , < 4.7.19.13 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Rest API Admin UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Sequence Editor UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Task UI	Affected: 4.7.30 , < 4.7.30.53 (custom) Unaffected: x , ≤ * (custom)
WSO2	WSO2 Carbon Governance	Affected: 4.8.37 , < 4.8.37.4 (custom) Unaffected: x , ≤ * (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-13394",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T12:32:20.578575Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T12:32:29.065Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.381",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.428",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.255",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.256",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.133",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.41",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.2.0.3",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.352",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.456",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.75",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.376",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.239",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.179",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.91",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.55",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.38",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.421",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.401",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.372",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.39",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.37",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.37",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.3",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.227",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.entitlement.ui",
          "product": "WSO2 Carbon Identity Entitlement UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.17.5.331",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.329",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.210",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.166",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.157",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui",
          "product": "WSO2 Carbon Identity Management UI1",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.17.5.330",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.331",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.22",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.328",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.329",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.31",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.210",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.26",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.166",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.21",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.10",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.5",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.736.1",
              "status": "affected",
              "version": "5.25.736",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.157",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.67",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.586.7",
              "status": "affected",
              "version": "7.8.586",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
          "product": "WSO2 Carbon Identity User Store Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.13",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.330",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.331",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.22",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.328",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.329",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.31",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.210",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.26",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.166",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.21",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.10",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.5",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.736.1",
              "status": "affected",
              "version": "5.25.736",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.157",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.67",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.586.7",
              "status": "affected",
              "version": "7.8.586",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.profiles.ui",
          "product": "WSO2 Carbon Registry Profiles UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.4",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.3",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.properties.ui",
          "product": "WSO2 Carbon Registry Properties UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.4",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.3",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.resource.ui",
          "product": "WSO2 Carbon Registry Resources UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.4",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.3",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.search.ui",
          "product": "WSO2 Carbon Registry Search UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.18",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.16",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.16",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.8",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.6",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.tenant.mgt.ui",
          "product": "WSO2 Stratos User Interface For Tenant CRUD Operations",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.1.6",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.7.3",
              "status": "affected",
              "version": "4.8.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.8.7",
              "status": "affected",
              "version": "4.9.8",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.10.7",
              "status": "affected",
              "version": "4.9.10",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.10.8",
              "status": "affected",
              "version": "4.9.10",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.20.5",
              "status": "affected",
              "version": "4.9.20",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.1",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.31.1",
              "status": "affected",
              "version": "4.9.31",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.34.1",
              "status": "affected",
              "version": "4.9.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.42.1",
              "status": "affected",
              "version": "4.9.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.0.7",
              "status": "affected",
              "version": "4.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.19.4",
              "status": "affected",
              "version": "4.11.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.34.3",
              "status": "affected",
              "version": "4.11.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.11.45.1",
              "status": "affected",
              "version": "4.11.45",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.multitenancy:org.wso2.carbon.tenant.sso.redirector.ui",
          "product": "WSO2 Stratos SSO Redirector UI Component",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.1.6",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.email.verification.ui",
          "product": "WSO2 Carbon Email Verification UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.14",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.event.simulator.ui",
          "product": "WSO2 Carbon Event Simulator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.2.11.1",
              "status": "affected",
              "version": "2.2.11",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.14.11",
              "status": "affected",
              "version": "2.2.14",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.14.12",
              "status": "affected",
              "version": "2.2.14",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.17.5",
              "status": "affected",
              "version": "2.2.17",
              "versionType": "custom"
            },
            {
              "lessThan": "2.3.1.4",
              "status": "affected",
              "version": "2.3.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2.3.5.6",
              "status": "affected",
              "version": "2.3.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.template.manager.ui",
          "product": "WSO2 Carbon Execution Manager UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.24.10",
              "status": "affected",
              "version": "5.2.24",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.26.22",
              "status": "affected",
              "version": "5.2.26",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.34.12",
              "status": "affected",
              "version": "5.2.34",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.41.7",
              "status": "affected",
              "version": "5.2.41",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.57.10",
              "status": "affected",
              "version": "5.2.57",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.5.9",
              "status": "affected",
              "version": "5.3.5",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.custom.lifecycles.checklist.ui",
          "product": "WSO2 Carbon Governance Custom Lifecycle Checklist UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.generic.ui",
          "product": "WSO2 Carbon Governance Generic Artifact User Interface",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.33.4",
              "status": "affected",
              "version": "4.8.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.34.5",
              "status": "affected",
              "version": "4.8.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.37.4",
              "status": "affected",
              "version": "4.8.37",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.lcm.ui",
          "product": "WSO2 Carbon Governance Life Cycles User Interface",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.governance.wsdltool.ui",
          "product": "WSO2 Carbon Governance WSDL Tool UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.14.4",
              "status": "affected",
              "version": "4.8.14",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.19.8",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.10",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.4",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.6",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.33.4",
              "status": "affected",
              "version": "4.8.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.34.5",
              "status": "affected",
              "version": "4.8.34",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.37.4",
              "status": "affected",
              "version": "4.8.37",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui",
          "product": "WSO2 Carbon New Data Sources UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.24.5",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.10",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.13",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.49.7",
              "status": "affected",
              "version": "4.7.49",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.52.5",
              "status": "affected",
              "version": "4.7.52",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.2.8",
              "status": "affected",
              "version": "4.9.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.11.2",
              "status": "affected",
              "version": "4.9.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.18.1",
              "status": "affected",
              "version": "4.9.18",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.info.ui",
          "product": "WSO2 Carbon Registry Info UI2",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.registry.relations.ui",
          "product": "WSO2 Carbon Registry Relations UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.11",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.16",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.15",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.12",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.8",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.10",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.9",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.4",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.2",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.2",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.50.1",
              "status": "affected",
              "version": "4.8.50",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.registry:org.wso2.carbon.registry.indexing",
          "product": "WSO2 Carbon Registry Indexing",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24",
              "status": "affected",
              "version": "4.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.security.mgt.ui",
          "product": "WSO2 Carbon Security UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127",
              "status": "affected",
              "version": "5.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.messaging:org.wso2.carbon.andes.event.ui",
          "product": "WSO2 Carbon Component Andes Event UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.3.12.3",
              "status": "affected",
              "version": "3.3.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.messaging:org.wso2.carbon.andes.ui",
          "product": "WSO2 Carbon Component Andes UI1",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.3.12.3",
              "status": "affected",
              "version": "3.3.12",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.mediation:org.wso2.carbon.business.messaging.hl7.store.ui",
          "product": "WSO2 Carbon HL7 Business Messaging Store UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbonorg.wso2.carbon.endpoint.ui",
          "product": "WSO2 Carbon Endpoint Editor UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.mediationorg.wso2.carbon.event.sink.config.ui",
          "product": "WSO2 Carbon Publish Event Mediator Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.commons:org.wso2.carbon.event.ui",
          "product": "WSO2 Carbon Eventing UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.business-process:org.wso2.carbon.humantask.ui",
          "product": "WSO2 Carbon HumanTask UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.27.10",
              "status": "affected",
              "version": "4.5.27",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.logging.admin.ui",
          "product": "WSO2 Carbon Logging UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.24.5",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.10",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.52.5",
              "status": "affected",
              "version": "4.7.52",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.templates.ui",
          "product": "WSO2 Carbon Template Editor UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.mediator.command.ui",
          "product": "WSO2 Carbon Command Mediator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.mediator.rule.ui",
          "product": "WSO2 Carbon Rule Mediator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.mediator.throttle.ui",
          "product": "WSO2 Carbon Throttle Mediator UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.ntask.core",
          "product": "WSO2 Carbon Tasks Core",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.19.13",
              "status": "affected",
              "version": "4.7.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.rest.api.ui",
          "product": "WSO2 Carbon Rest API Admin UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.sequences.ui",
          "product": "WSO2 Carbon Sequence Editor UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.task.ui",
          "product": "WSO2 Carbon Task UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.30.53",
              "status": "affected",
              "version": "4.7.30",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.api",
          "product": "WSO2 Carbon Governance",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.37.4",
              "status": "affected",
              "version": "4.8.37",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user\u0027s browser into unknowingly executing unintended actions.\n\nAn attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2\u0027s security guidelines."
            }
          ],
          "value": "The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user\u0027s browser into unknowingly executing unintended actions.\n\nAn attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2\u0027s security guidelines."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-234",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-234 CAPEC-234: Cross-Site Request Forgery"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T07:33:17.645Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2025-4800",
        "discovery": "INTERNAL"
      },
      "title": "Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2025-13394",
    "datePublished": "2026-08-06T07:33:17.645Z",
    "dateReserved": "2025-11-19T06:17:35.259Z",
    "dateUpdated": "2026-08-06T12:32:29.065Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-8008 (GCVE-0-2024-8008)

Vulnerability from cvelistv5 – Published: 2025-06-02 16:48 – Updated: 2026-10-16 11:39

Title

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Summary

Severity

5.2 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-02 17:05 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Assigner

WSO2 CNA under the mitre root

CNA scorecard B 89/100 over 68 records in the last 180 days details

References

1 reference

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory

Impacted products

10 products

Vendor	Product	Version
WSO2	WSO2 Enterprise Integrator	Unknown: 0 , < 6.6.0 (custom) Affected: 6.6.0 , < 6.6.0.211 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator::::::::
WSO2	WSO2 API Manager	Unknown: 0 , < 3.1.0 (custom) Affected: 3.1.0 , < 3.1.0.305 (custom) Affected: 3.2.0 , < 3.2.0.396 (custom) Affected: 3.2.1 , < 3.2.1.28 (custom) Affected: 4.0.0 , < 4.0.0.313 (custom) Affected: 4.1.0 , < 4.1.0.182 (custom) Affected: 4.2.0 , < 4.2.0.121 (custom) Affected: 4.3.0 , < 4.3.0.32 (custom) Affected: 4.4.0 , < 4.4.0.1 (custom) Affected: 4.5.0 , < 4.5.0.16 (custom) cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager::::::::
WSO2	WSO2 Identity Server as Key Manager	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.321 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager::::::::
WSO2	WSO2 Identity Server	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.328 (custom) Affected: 5.11.0 , < 5.11.0.374 (custom) Affected: 6.0.0 , < 6.0.0.216 (custom) Affected: 6.1.0 , < 6.1.0.201 (custom) Affected: 7.0.0 , < 7.0.0.69 (custom) cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server::::::::
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.374 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
WSO2	WSO2 Open Banking AM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.354 (custom) cpe:2.3:a:wso2:wso2_open_banking_am::::::::
WSO2	WSO2 Traffic Manager	Affected: 4.5.0 , < 4.5.0.16 (custom) cpe:2.3:a:wso2:wso2_traffic_manager::::::::
WSO2	WSO2 API Control Plane	Affected: 4.5.0 , < 4.5.0.17 (custom) cpe:2.3:a:wso2:wso2_api_control_plane::::::::
WSO2	WSO2 Universal Gateway	Affected: 4.5.0 , < 4.5.0.16 (custom) cpe:2.3:a:wso2:wso2_universal_gateway::::::::
WSO2	WSO2 Carbon Identity User Store Configuration UI	Affected: 5.14.127 , < 5.14.127.9 (custom) Affected: 5.17.5 , < 5.17.5.289 (custom) Affected: 5.17.118 , < 5.17.118.10 (custom) Affected: 5.18.187 , < 5.18.187.276 (custom) Affected: 5.18.248 , < 5.18.248.22 (custom) Affected: 5.23.8 , < 5.23.8.193 (custom) Affected: 5.24.8 , < 5.24.8.11 (custom) Affected: 5.25.92 , < 5.25.92.104 (custom) Affected: 5.25.705 , < 5.25.705.10 (custom) Affected: 5.25.713 , < 5.25.713.1 (custom) Affected: 5.25.724 , < 5.25.724.1 (custom) Affected: 7.0.78 , < 7.0.78.46 (custom) Unaffected: 5.25.725 , ≤ 5.25.* (custom) Unaffected: 5.27.0 , ≤ 5.27.* (custom) Unaffected: 7.5.12 , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8008",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-02T17:05:11.526830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-02T17:05:24.975Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.211",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.305",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.396",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.28",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.313",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.182",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.121",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.32",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.1",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.16",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.321",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.328",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.374",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.216",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.201",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.69",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.374",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.354",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.16",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.17",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.16",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
          "product": "WSO2 Carbon Identity User Store Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.9",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.289",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.10",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.276",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.22",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.193",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.11",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.104",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.10",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.1",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.1",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.46",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.25.*",
              "status": "unaffected",
              "version": "5.25.725",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.27.*",
              "status": "unaffected",
              "version": "5.27.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.5.12",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.0.211",
                  "versionStartIncluding": "6.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.0.305",
                  "versionStartIncluding": "3.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.0.396",
                  "versionStartIncluding": "3.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.1.28",
                  "versionStartIncluding": "3.2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.0.313",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.0.182",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.0.121",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0.32",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.0.1",
                  "versionStartIncluding": "4.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.16",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.321",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.328",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.0.374",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0.216",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.0.201",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.0.69",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.374",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.354",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.16",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.17",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.5.0.16",
                  "versionStartIncluding": "4.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.9",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.289",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.10",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.276",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.22",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.193",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.11",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.104",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.10",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.713.1",
                  "versionStartIncluding": "5.25.713",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.724.1",
                  "versionStartIncluding": "5.25.724",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.46",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.25.*",
                  "versionStartIncluding": "5.25.725",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "5.27.*",
                  "versionStartIncluding": "5.27.0",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "*",
                  "versionStartIncluding": "7.5.12",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.\u003cbr\u003e\u003cbr\u003eThis vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible."
            }
          ],
          "value": "A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.\n\nThis vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T11:39:49.442Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2024-3178",
        "discovery": "INTERNAL"
      },
      "title": "Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-8008",
    "datePublished": "2025-06-02T16:48:12.479Z",
    "dateReserved": "2024-08-20T11:32:44.245Z",
    "dateUpdated": "2026-10-16T11:39:49.442Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}