Search
Find a vulnerability
Search criteria
110 vulnerabilities found for WSO2 Identity Server as Key Manager by WSO2
CVE-2025-1397 (GCVE-0-2025-1397)
Vulnerability from nvd – Published: 2026-11-03 06:07 – Updated: 2026-11-03 20:03
VLAI
EPSS
VEX
Title
Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
Summary
When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.
A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 20:03 UTC
CWE
- CWE-862 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.10
(custom)
cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.10
(custom)
cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.321 (custom) Affected: 3.2.0 , < 3.2.0.414 (custom) Affected: 3.2.1 , < 3.2.1.50 (custom) Affected: 4.0.0 , < 4.0.0.335 (custom) Affected: 4.1.0 , < 4.1.0.211 (custom) Affected: 4.2.0 , < 4.2.0.150 (custom) Affected: 4.3.0 , < 4.3.0.63 (custom) Affected: 4.4.0 , < 4.4.0.26 (custom) Affected: 4.5.0 , < 4.5.0.10 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.11
(custom)
cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.346 (custom) Affected: 5.11.0 , < 5.11.0.396 (custom) Affected: 6.0.0 , < 6.0.0.232 (custom) Affected: 6.1.0 , < 6.1.0.224 (custom) Affected: 7.0.0 , < 7.0.0.93 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.370 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.390 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.339 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon OAuth |
Affected:
6.4.2 , < 6.4.2.155
(custom)
Affected: 6.4.111 , < 6.4.111.134 (custom) Affected: 6.4.176 , < 6.4.176.25 (custom) Affected: 6.4.180 , < 6.4.180.11 (custom) Affected: 6.8.0 , < 6.8.0.49 (custom) Affected: 6.9.6 , < 6.9.6.22 (custom) Affected: 6.11.21 , < 6.11.21.75 (custom) Affected: 6.13.16 , < 6.13.16.15 (custom) Affected: 6.13.19 , < 6.13.19.9 (custom) Affected: 6.13.27 , < 6.13.27.2 (custom) Affected: 7.0.26 , < 7.0.26.58 (custom) cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* |
|
| WSO2 | JWT Grant Type For OAuth2 |
Affected:
1.0.26 , < 1.0.26.6
(custom)
Affected: 1.0.26 , < 1.0.26.7 (custom) Affected: 1.0.31 , < 1.0.31.3 (custom) Affected: 1.1.0 , < 1.1.0.2 (custom) Affected: 2.0.4 , < 2.0.4.3 (custom) Affected: 2.1.1 , < 2.1.1.2 (custom) Affected: 2.2.0 , < 2.2.0.3 (custom) Affected: 2.2.4 , < 2.2.4.1 (custom) Affected: 2.3.1 , < 2.3.1.4 (custom) cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T20:03:01.670683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:03:19.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.321",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.414",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.50",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.335",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.211",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.150",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.63",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.26",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.346",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.396",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.232",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.224",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.93",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.370",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.390",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.339",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"product": "WSO2 Carbon OAuth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.155",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.111.134",
"status": "affected",
"version": "6.4.111",
"versionType": "custom"
},
{
"lessThan": "6.4.176.25",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.11",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.49",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.22",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.75",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.15",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.9",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "6.13.27.2",
"status": "affected",
"version": "6.13.27",
"versionType": "custom"
},
{
"lessThan": "7.0.26.58",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt",
"product": "JWT Grant Type For OAuth2",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.26.6",
"status": "affected",
"version": "1.0.26",
"versionType": "custom"
},
{
"lessThan": "1.0.26.7",
"status": "affected",
"version": "1.0.26",
"versionType": "custom"
},
{
"lessThan": "1.0.31.3",
"status": "affected",
"version": "1.0.31",
"versionType": "custom"
},
{
"lessThan": "1.1.0.2",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "2.0.4.3",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
},
{
"lessThan": "2.1.1.2",
"status": "affected",
"version": "2.1.1",
"versionType": "custom"
},
{
"lessThan": "2.2.0.3",
"status": "affected",
"version": "2.2.0",
"versionType": "custom"
},
{
"lessThan": "2.2.4.1",
"status": "affected",
"version": "2.2.4",
"versionType": "custom"
},
{
"lessThan": "2.3.1.4",
"status": "affected",
"version": "2.3.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.321",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.414",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.50",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.335",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.211",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.150",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.63",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.26",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.346",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.396",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.232",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.224",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.93",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.370",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.390",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.339",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.155",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.111.134",
"versionStartIncluding": "6.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.25",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.11",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.49",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.22",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.75",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.15",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.9",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.27.2",
"versionStartIncluding": "6.13.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.58",
"versionStartIncluding": "7.0.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.26.6",
"versionStartIncluding": "1.0.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.26.7",
"versionStartIncluding": "1.0.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.31.3",
"versionStartIncluding": "1.0.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0.2",
"versionStartIncluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.4.3",
"versionStartIncluding": "2.0.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.1.2",
"versionStartIncluding": "2.1.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.0.3",
"versionStartIncluding": "2.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.4.1",
"versionStartIncluding": "2.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.1.4",
"versionStartIncluding": "2.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.\n\nA malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP\u0027s disabled state."
}
],
"value": "When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.\n\nA malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP\u0027s disabled state."
}
],
"impacts": [
{
"capecId": "CAPEC-346",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-346 CAPEC-346: Token Generation/Distribution Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T06:07:57.302Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4010",
"discovery": "INTERNAL"
},
"title": "Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-1397",
"datePublished": "2026-11-03T06:07:57.302Z",
"dateReserved": "2025-02-17T14:31:46.349Z",
"dateUpdated": "2026-11-03T20:03:19.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-12139 (GCVE-0-2024-12139)
Vulnerability from nvd – Published: 2026-11-02 17:34 – Updated: 2026-11-02 19:10
VLAI
EPSS
VEX
Title
Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
Summary
The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.
By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:09 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.2.1
(custom)
Affected: 3.2.1 , < 3.2.1.49 (custom) Affected: 4.1.0 , < 4.1.0.210 (custom) Affected: 4.2.0 , < 4.2.0.148 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.346 (custom) Affected: 5.11.0 , < 5.11.0.385 (custom) Affected: 6.0.0 , < 6.0.0.229 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.339 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12139",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:09:36.270401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:10:02.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.2.1",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.49",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.210",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.148",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.346",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.385",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.229",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.339",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.49",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.210",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.148",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.346",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.385",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.229",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.339",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions."
}
],
"value": "The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions."
}
],
"impacts": [
{
"capecId": "CAPEC-148",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-148 Content Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:34:20.302Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3805",
"discovery": "INTERNAL"
},
"title": "Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-12139",
"datePublished": "2026-11-02T17:34:20.302Z",
"dateReserved": "2024-12-04T10:21:25.665Z",
"dateUpdated": "2026-11-02T19:10:02.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9517 (GCVE-0-2024-9517)
Vulnerability from nvd – Published: 2026-11-02 11:30 – Updated: 2026-11-02 16:55
VLAI
EPSS
VEX
Title
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
Summary
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.
This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:55 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.308 (custom) Affected: 3.2.0 , < 3.2.0.429 (custom) Affected: 3.2.1 , < 3.2.1.49 (custom) Affected: 4.0.0 , < 4.0.0.315 (custom) Affected: 4.1.0 , < 4.1.0.214 (custom) Affected: 4.2.0 , < 4.2.0.149 (custom) Affected: 4.3.0 , < 4.3.0.62 (custom) Affected: 4.4.0 , < 4.4.0.25 (custom) Affected: 4.5.0 , < 4.5.0.9 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.9
(custom)
cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.9
(custom)
cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.10
(custom)
cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.324 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.331 (custom) Affected: 5.11.0 , < 5.11.0.376 (custom) Affected: 6.0.0 , < 6.0.0.219 (custom) Affected: 6.1.0 , < 6.1.0.205 (custom) Affected: 7.0.0 , < 7.0.0.73 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.357 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.377 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon OAuth |
Affected:
6.4.2 , < 6.4.2.148
(custom)
Affected: 6.4.111 , < 6.4.111.122 (custom) Affected: 6.4.176 , < 6.4.176.26 (custom) Affected: 6.4.180 , < 6.4.180.10 (custom) Affected: 6.8.0 , < 6.8.0.44 (custom) Affected: 6.9.6 , < 6.9.6.21 (custom) Affected: 6.11.21 , < 6.11.21.64 (custom) Affected: 6.13.16 , < 6.13.16.13 (custom) Affected: 6.13.19 , < 6.13.19.7 (custom) Affected: 6.13.27 , < 6.13.27.1 (custom) Affected: 7.0.26 , < 7.0.26.37 (custom) cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9517",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:55:20.360718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:55:34.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.308",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.429",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.49",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.315",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.214",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.149",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.62",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.25",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.9",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.9",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.9",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.324",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.331",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.376",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.219",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.205",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.73",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.357",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.377",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"product": "WSO2 Carbon OAuth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.148",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.111.122",
"status": "affected",
"version": "6.4.111",
"versionType": "custom"
},
{
"lessThan": "6.4.176.26",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.10",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.44",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.21",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.64",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.13",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.7",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "6.13.27.1",
"status": "affected",
"version": "6.13.27",
"versionType": "custom"
},
{
"lessThan": "7.0.26.37",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.308",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.429",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.49",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.315",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.214",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.149",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.62",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.25",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.9",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.9",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.9",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.324",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.331",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.376",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.219",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.205",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.73",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.357",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.377",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.148",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.111.122",
"versionStartIncluding": "6.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.26",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.10",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.44",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.21",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.64",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.13",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.7",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.27.1",
"versionStartIncluding": "6.13.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.37",
"versionStartIncluding": "7.0.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.\n\nThis vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account."
}
],
"value": "The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.\n\nThis vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account."
}
],
"impacts": [
{
"capecId": "CAPEC-24",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-24 CAPEC-24: Session Fixation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T11:30:15.562Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3676",
"discovery": "INTERNAL"
},
"title": "Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-9517",
"datePublished": "2026-11-02T11:30:15.562Z",
"dateReserved": "2024-10-04T07:58:59.333Z",
"dateUpdated": "2026-11-02T16:55:34.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-2372 (GCVE-0-2024-2372)
Vulnerability from nvd – Published: 2026-11-02 11:00 – Updated: 2026-11-02 16:57
VLAI
EPSS
VEX
Title
Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
Summary
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:56 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.383 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.0.0
(custom)
Affected: 3.0.0 , < 3.0.0.160 (custom) Affected: 3.1.0 , < 3.1.0.335 (custom) Affected: 3.2.0 , < 3.2.0.432 (custom) Affected: 3.2.1 , < 3.2.1.51 (custom) Affected: 4.0.0 , < 4.0.0.310 (custom) Affected: 4.1.0 , < 4.1.0.208 (custom) Affected: 4.2.0 , < 4.2.0.146 (custom) Affected: 4.3.0 , < 4.3.0.59 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.9.0
(custom)
Affected: 5.9.0 , < 5.9.0.163 (custom) Affected: 5.10.0 , < 5.10.0.355 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.404 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.212 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.9.0
(custom)
Affected: 5.9.0 , < 5.9.0.154 (custom) Affected: 5.10.0 , < 5.10.0.291 (custom) Affected: 5.11.0 , < 5.11.0.371 (custom) Affected: 6.0.0 , < 6.0.0.178 (custom) Affected: 6.1.0 , < 6.1.0.134 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Registry Kernel |
Affected:
4.5.1 , < 4.5.1.36
(custom)
Affected: 4.5.3 , < 4.5.3.36 (custom) Affected: 4.6.0 , < 4.6.0.139 (custom) Affected: 4.6.0 , < 4.6.0.1544 (custom) Affected: 4.6.1 , < 4.6.1.105 (custom) Affected: 4.6.2 , < 4.6.2.321 (custom) Affected: 4.6.3 , < 4.6.3.28 (custom) Affected: 4.6.4 , < 4.6.4.11 (custom) Affected: 4.7.1 , < 4.7.1.47 (custom) Affected: 4.8.1 , < 4.8.1.27 (custom) Affected: 4.8.1 , < 4.8.1.31 (custom) Affected: 4.9.0 , < 4.9.0.46 (custom) Affected: 4.9.26 , < 4.9.26.18 (custom) cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:56:50.364469Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:57:01.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.383",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.0.0.160",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.335",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.432",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.51",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.310",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.208",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.146",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.59",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.9.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.9.0.163",
"status": "affected",
"version": "5.9.0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.355",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.404",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.212",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.9.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.9.0.154",
"status": "affected",
"version": "5.9.0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.291",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.371",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.178",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.134",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.registry.core",
"product": "WSO2 Carbon Registry Kernel",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.1.36",
"status": "affected",
"version": "4.5.1",
"versionType": "custom"
},
{
"lessThan": "4.5.3.36",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.139",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.1544",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.105",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.321",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.28",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.11",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.47",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.27",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.31",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.46",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.18",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.383",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.0.160",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.335",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.432",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.51",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.310",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.208",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.146",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.59",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.0.163",
"versionStartIncluding": "5.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.355",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.404",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.212",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.0.154",
"versionStartIncluding": "5.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.291",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.371",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.178",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.134",
"versionStartIncluding": "6.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.1.36",
"versionStartIncluding": "4.5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.36",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.139",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.1544",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.105",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.2.321",
"versionStartIncluding": "4.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.28",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.11",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.47",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.27",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.31",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.46",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.18",
"versionStartIncluding": "4.9.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm."
}
],
"value": "The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm."
}
],
"impacts": [
{
"capecId": "CAPEC-603",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-603 CAPEC-603: Open Redirect"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T11:00:23.105Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3254",
"discovery": "INTERNAL"
},
"title": "Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-2372",
"datePublished": "2026-11-02T11:00:23.105Z",
"dateReserved": "2024-03-11T13:20:39.998Z",
"dateUpdated": "2026-11-02T16:57:01.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18800 (GCVE-0-2026-18800)
Vulnerability from nvd – Published: 2026-11-02 09:59 – Updated: 2026-11-02 17:10
VLAI
EPSS
VEX
Title
Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
Summary
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.
A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.357 (custom) Affected: 3.2.0 , < 3.2.0.465 (custom) Affected: 3.2.1 , < 3.2.1.84 (custom) Affected: 4.1.0 , < 4.1.0.249 (custom) Affected: 4.2.0 , < 4.2.0.189 (custom) Affected: 4.3.0 , < 4.3.0.100 (custom) Affected: 4.4.0 , < 4.4.0.64 (custom) Affected: 4.5.0 , < 4.5.0.49 (custom) Affected: 4.6.0 , < 4.6.0.13 (custom) |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.48 (custom) Affected: 4.6.0 , < 4.6.0.13 (custom) |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.50 (custom) Affected: 4.6.0 , < 4.6.0.14 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.49 (custom) Affected: 4.6.0 , < 4.6.0.13 (custom) |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.386 (custom) Affected: 5.11.0 , < 5.11.0.433 (custom) Affected: 6.0.0 , < 6.0.0.260 (custom) Affected: 6.1.0 , < 6.1.0.261 (custom) Affected: 7.0.0 , < 7.0.0.139 (custom) Affected: 7.1.0 , < 7.1.0.47 (custom) Affected: 7.2.0 , < 7.2.0.8 (custom) |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.377 (custom) |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.426 (custom) |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.406 (custom) |
|
| WSO2 | WSO2 Carbon Event Publisher Core |
Affected:
0 , < 5.2.65
(custom)
Affected: 5.3.0 , < 5.3.28 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:46.475225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:10:08.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.357",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.465",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.84",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.249",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.189",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.100",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.64",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.49",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.13",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.48",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.13",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.50",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.14",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.49",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.13",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.386",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.433",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.260",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.261",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.139",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.47",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
},
{
"lessThan": "7.2.0.8",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.377",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.426",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.406",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.core",
"product": "WSO2 Carbon Event Publisher Core",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.2.65",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.3.28",
"status": "affected",
"version": "5.3.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.\n\nA malicious actor with access to the \u0027wso2carbon\u0027 log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets."
}
],
"value": "When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.\n\nA malicious actor with access to the \u0027wso2carbon\u0027 log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets."
}
],
"impacts": [
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116: Excavation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T09:59:26.522Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4897",
"discovery": "INTERNAL"
},
"title": "Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-18800",
"datePublished": "2026-11-02T09:59:26.522Z",
"dateReserved": "2026-08-04T11:14:13.708Z",
"dateUpdated": "2026-11-02T17:10:08.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13647 (GCVE-0-2025-13647)
Vulnerability from nvd – Published: 2026-11-02 09:20 – Updated: 2026-11-02 19:20
VLAI
EPSS
VEX
Title
Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
Summary
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.
Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:20 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.381 (custom) Affected: 5.11.0 , < 5.11.0.428 (custom) Affected: 6.0.0 , < 6.0.0.255 (custom) Affected: 6.1.0 , < 6.1.0.255 (custom) Affected: 7.0.0 , < 7.0.0.133 (custom) Affected: 7.1.0 , < 7.1.0.41 (custom) Affected: 7.2.0 , < 7.2.0.3 (custom) |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.421 (custom) |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.372 (custom) |
|
| WSO2 | WSO2 Identity Server Keystore Rest API Commons |
Affected:
1.0.82 , < 1.0.82.25
(custom)
Affected: 1.0.190 , < 1.0.190.17 (custom) Affected: 1.2.3 , < 1.2.3.6 (custom) Affected: 1.2.23 , < 1.2.23.10 (custom) Affected: 1.2.176 , < 1.2.176.18 (custom) Affected: 1.3.83 , < 1.3.83.10 (custom) Affected: 1.3.213 , < 1.3.213.1 (custom) Unaffected: 1.3.221 , ≤ * (custom) |
|
| WSO2 | WSO2 Identity Server Keystore Rest API V1 |
Affected:
1.0.82 , < 1.0.82.25
(custom)
Affected: 1.0.190 , < 1.0.190.17 (custom) Affected: 1.2.3 , < 1.2.3.6 (custom) Affected: 1.2.23 , < 1.2.23.10 (custom) Affected: 1.2.176 , < 1.2.176.18 (custom) Affected: 1.3.83 , < 1.3.83.10 (custom) Affected: 1.3.213 , < 1.3.213.1 (custom) Unaffected: 1.3.221 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:20:07.726881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:20:26.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.381",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.428",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.255",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.255",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.133",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.41",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
},
{
"lessThan": "7.2.0.3",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.421",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.372",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.api.server.keystore.management.common",
"product": "WSO2 Identity Server Keystore Rest API Commons",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.82.25",
"status": "affected",
"version": "1.0.82",
"versionType": "custom"
},
{
"lessThan": "1.0.190.17",
"status": "affected",
"version": "1.0.190",
"versionType": "custom"
},
{
"lessThan": "1.2.3.6",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.23.10",
"status": "affected",
"version": "1.2.23",
"versionType": "custom"
},
{
"lessThan": "1.2.176.18",
"status": "affected",
"version": "1.2.176",
"versionType": "custom"
},
{
"lessThan": "1.3.83.10",
"status": "affected",
"version": "1.3.83",
"versionType": "custom"
},
{
"lessThan": "1.3.213.1",
"status": "affected",
"version": "1.3.213",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.3.221",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1",
"product": "WSO2 Identity Server Keystore Rest API V1",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.82.25",
"status": "affected",
"version": "1.0.82",
"versionType": "custom"
},
{
"lessThan": "1.0.190.17",
"status": "affected",
"version": "1.0.190",
"versionType": "custom"
},
{
"lessThan": "1.2.3.6",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.23.10",
"status": "affected",
"version": "1.2.23",
"versionType": "custom"
},
{
"lessThan": "1.2.176.18",
"status": "affected",
"version": "1.2.176",
"versionType": "custom"
},
{
"lessThan": "1.3.83.10",
"status": "affected",
"version": "1.3.83",
"versionType": "custom"
},
{
"lessThan": "1.3.213.1",
"status": "affected",
"version": "1.3.213",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.3.221",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.\n\nSuccessful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system."
}
],
"value": "The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.\n\nSuccessful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system."
}
],
"impacts": [
{
"capecId": "CAPEC-173",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-173 CAPEC-173: Information Gathering"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T09:20:52.186Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4751",
"discovery": "INTERNAL"
},
"title": "Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-13647",
"datePublished": "2026-11-02T09:20:52.186Z",
"dateReserved": "2025-11-25T09:37:21.342Z",
"dateUpdated": "2026-11-02T19:20:26.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11969 (GCVE-0-2025-11969)
Vulnerability from nvd – Published: 2026-11-02 05:53 – Updated: 2026-11-02 19:41
VLAI
EPSS
VEX
Title
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
Summary
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.
Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:41 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.347 (custom) Affected: 3.2.0 , < 3.2.0.450 (custom) Affected: 3.2.1 , < 3.2.1.70 (custom) Affected: 4.0.0 , < 4.0.0.370 (custom) Affected: 4.1.0 , < 4.1.0.233 (custom) Affected: 4.2.0 , < 4.2.0.173 (custom) Affected: 4.3.0 , < 4.3.0.85 (custom) Affected: 4.4.0 , < 4.4.0.49 (custom) Affected: 4.5.0 , < 4.5.0.32 (custom) |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.367 (custom) |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.396 (custom) |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.416 (custom) |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.33 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.31 (custom) |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.31 (custom) |
|
| WSO2 | WSO2 Carbon API Manager Rest API Utility |
Affected:
6.6.163 , < 6.6.163.159
(custom)
Affected: 6.6.163 , < 6.6.163.160 (custom) Affected: 6.7.206 , < 6.7.206.574 (custom) Affected: 6.7.206 , < 6.7.206.576 (custom) Affected: 6.7.210 , < 6.7.210.69 (custom) Affected: 6.7.210 , < 6.7.210.71 (custom) Affected: 9.0.174 , < 9.0.174.536 (custom) Affected: 9.20.74 , < 9.20.74.384 (custom) Affected: 9.20.74 , < 9.20.74.385 (custom) Affected: 9.28.116 , < 9.28.116.380 (custom) Affected: 9.29.120 , < 9.29.120.202 (custom) Affected: 9.30.67 , < 9.30.67.125 (custom) Affected: 9.31.86 , < 9.31.86.90 (custom) Unaffected: 9.32.147 , ≤ * (custom) |
|
| WSO2 | WSO2 Carbon API Manager Rest API Common Functions |
Affected:
9.0.174 , < 9.0.174.538
(custom)
Affected: 9.20.74 , < 9.20.74.385 (custom) Affected: 9.28.116 , < 9.28.116.382 (custom) Affected: 9.29.120 , < 9.29.120.204 (custom) Affected: 9.30.67 , < 9.30.67.126 (custom) Affected: 9.31.86 , < 9.31.86.91 (custom) Unaffected: 9.32.147 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:41:02.813424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:41:15.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.347",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.450",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.70",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.370",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.233",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.173",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.85",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.49",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.32",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.367",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.396",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.416",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.33",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.31",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.31",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
"product": "WSO2 Carbon API Manager Rest API Utility",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.163.159",
"status": "affected",
"version": "6.6.163",
"versionType": "custom"
},
{
"lessThan": "6.6.163.160",
"status": "affected",
"version": "6.6.163",
"versionType": "custom"
},
{
"lessThan": "6.7.206.574",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.206.576",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.210.69",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "6.7.210.71",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "9.0.174.536",
"status": "affected",
"version": "9.0.174",
"versionType": "custom"
},
{
"lessThan": "9.20.74.384",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.20.74.385",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.380",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.202",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.125",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.90",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.147",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common",
"product": "WSO2 Carbon API Manager Rest API Common Functions",
"vendor": "WSO2",
"versions": [
{
"lessThan": "9.0.174.538",
"status": "affected",
"version": "9.0.174",
"versionType": "custom"
},
{
"lessThan": "9.20.74.385",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.382",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.204",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.126",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.91",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.147",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager\u0027s API Gateway are not affected by this vulnerability."
}
],
"value": "The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager\u0027s API Gateway are not affected by this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-10",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-10 CAPEC-10: Access Control"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T05:53:51.375Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4733",
"discovery": "INTERNAL"
},
"title": "Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-11969",
"datePublished": "2026-11-02T05:53:51.375Z",
"dateReserved": "2025-10-20T15:28:50.917Z",
"dateUpdated": "2026-11-02T19:41:15.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3583 (GCVE-0-2026-3583)
Vulnerability from nvd – Published: 2026-10-28 19:21 – Updated: 2026-10-29 02:02
VLAI
EPSS
VEX
Title
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Summary
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.
The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:51 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.367 (custom) Affected: 3.2.0 , < 3.2.0.475 (custom) Affected: 3.2.1 , < 3.2.1.106 (custom) Affected: 4.0.0 , < 4.0.0.394 (custom) Affected: 4.1.0 , < 4.1.0.267 (custom) Affected: 4.2.0 , < 4.2.0.207 (custom) Affected: 4.3.0 , < 4.3.0.120 (custom) Affected: 4.4.0 , < 4.4.0.83 (custom) Affected: 4.5.0 , < 4.5.0.67 (custom) Affected: 4.6.0 , < 4.6.0.29 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.65 (custom) Affected: 4.6.0 , < 4.6.0.29 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.67 (custom) Affected: 4.6.0 , < 4.6.0.29 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.68 (custom) Affected: 4.6.0 , < 4.6.0.30 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.397 (custom) Affected: 5.11.0 , < 5.11.0.444 (custom) Affected: 6.0.0 , < 6.0.0.270 (custom) Affected: 6.1.0 , < 6.1.0.269 (custom) Affected: 7.0.0 , < 7.0.0.152 (custom) Affected: 7.1.0 , < 7.1.0.61 (custom) Affected: 7.2.0 , < 7.2.0.20 (custom) Affected: 7.3.0 , < 7.3.0.1 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.434 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.387 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.414 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon OAuth |
Affected:
6.4.2 , < 6.4.2.178
(custom)
Affected: 6.4.111 , < 6.4.111.174 (custom) Affected: 6.4.176 , < 6.4.176.38 (custom) Affected: 6.4.180 , < 6.4.180.25 (custom) Affected: 6.8.0 , < 6.8.0.59 (custom) Affected: 6.9.6 , < 6.9.6.36 (custom) Affected: 6.11.21 , < 6.11.21.118 (custom) Affected: 6.13.16 , < 6.13.16.32 (custom) Affected: 6.13.19 , < 6.13.19.23 (custom) Affected: 6.13.27 , < 6.13.27.21 (custom) Affected: 6.13.41 , < 6.13.41.9 (custom) Affected: 6.14.14 , < 6.14.14.3 (custom) Affected: 7.0.26 , < 7.0.26.103 (custom) Affected: 7.0.259 , < 7.0.259.54 (custom) Affected: 7.0.385 , < 7.0.385.15 (custom) Affected: 7.4.99 , < 7.4.99.5 (custom) Unaffected: 7.5.78 , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:51:44.830935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:02:14.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.367",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.475",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.106",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.394",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.267",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.207",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.120",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.83",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.67",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.29",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.65",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.29",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.67",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.29",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.68",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.30",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.397",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.444",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.270",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.269",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.152",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.61",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
},
{
"lessThan": "7.2.0.20",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
},
{
"lessThan": "7.3.0.1",
"status": "affected",
"version": "7.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.434",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.387",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.414",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"product": "WSO2 Carbon OAuth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.178",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.111.174",
"status": "affected",
"version": "6.4.111",
"versionType": "custom"
},
{
"lessThan": "6.4.176.38",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.25",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.59",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.36",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.118",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.32",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.23",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "6.13.27.21",
"status": "affected",
"version": "6.13.27",
"versionType": "custom"
},
{
"lessThan": "6.13.41.9",
"status": "affected",
"version": "6.13.41",
"versionType": "custom"
},
{
"lessThan": "6.14.14.3",
"status": "affected",
"version": "6.14.14",
"versionType": "custom"
},
{
"lessThan": "7.0.26.103",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
},
{
"lessThan": "7.0.259.54",
"status": "affected",
"version": "7.0.259",
"versionType": "custom"
},
{
"lessThan": "7.0.385.15",
"status": "affected",
"version": "7.0.385",
"versionType": "custom"
},
{
"lessThan": "7.4.99.5",
"status": "affected",
"version": "7.4.99",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.5.78",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.367",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.475",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.106",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.394",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.267",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.207",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.120",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.83",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.67",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.29",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.65",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.29",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.67",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.29",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.68",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.30",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.397",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.444",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.270",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.269",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.152",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0.61",
"versionStartIncluding": "7.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.0.20",
"versionStartIncluding": "7.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.0.1",
"versionStartIncluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.434",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.387",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.414",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.178",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.111.174",
"versionStartIncluding": "6.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.38",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.25",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.59",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.36",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.118",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.32",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.23",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.27.21",
"versionStartIncluding": "6.13.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.41.9",
"versionStartIncluding": "6.13.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.14.3",
"versionStartIncluding": "6.14.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.103",
"versionStartIncluding": "7.0.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.259.54",
"versionStartIncluding": "7.0.259",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.385.15",
"versionStartIncluding": "7.0.385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4.99.5",
"versionStartIncluding": "7.4.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "7.5.78",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.\n\nThe security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows."
}
],
"value": "When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.\n\nThe security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows."
}
],
"impacts": [
{
"capecId": "CAPEC-250",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-250 CAPEC-250: Session Fixation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:21:34.577Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution"
}
],
"source": {
"advisory": "WSO2-2026-5175",
"discovery": "INTERNAL"
},
"title": "Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-3583",
"datePublished": "2026-10-28T19:21:34.577Z",
"dateReserved": "2026-03-05T02:24:55.645Z",
"dateUpdated": "2026-10-29T02:02:14.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14260 (GCVE-0-2025-14260)
Vulnerability from nvd – Published: 2026-10-28 19:21 – Updated: 2026-11-03 11:02
VLAI
EPSS
VEX
Title
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
Summary
Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:52 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.354 (custom) Affected: 3.2.0 , < 3.2.0.458 (custom) Affected: 3.2.1 , < 3.2.1.99 (custom) Affected: 4.0.0 , < 4.0.0.379 (custom) Affected: 4.1.0 , < 4.1.0.265 (custom) Affected: 4.2.0 , < 4.2.0.205 (custom) Affected: 4.3.0 , < 4.3.0.115 (custom) Affected: 4.4.0 , < 4.4.0.79 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.374 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.403 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.423 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.383 (custom) Affected: 5.11.0 , < 5.11.0.430 (custom) Affected: 6.0.0 , < 6.0.0.256 (custom) Affected: 6.1.0 , < 6.1.0.257 (custom) Affected: 7.0.0 , < 7.0.0.134 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | SAML2 SSO Authenticator UI Bundle |
Affected:
5.5.0 , < 5.5.0.2
(custom)
Affected: 5.5.2 , < 5.5.2.5 (custom) Affected: 5.5.9 , < 5.5.9.4 (custom) Affected: 5.5.10 , < 5.5.10.1 (custom) Affected: 5.6.4 , < 5.6.4.1 (custom) Affected: 5.7.2 , < 5.7.2.1 (custom) Affected: 5.8.3 , < 5.8.3.1 (custom) Affected: 5.8.7 , < 5.8.7.2 (custom) Affected: 5.9.4 , < 5.9.4.2 (custom) Unaffected: 5.9.9 , ≤ * (custom) cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon UI |
Affected:
4.6.0 , < 4.6.0.2300
(custom)
Affected: 4.6.1 , < 4.6.1.165 (custom) Affected: 4.6.3 , < 4.6.3.46 (custom) Affected: 4.6.4 , < 4.6.4.28 (custom) Affected: 4.7.1 , < 4.7.1.79 (custom) Affected: 4.8.1 , < 4.8.1.50 (custom) Affected: 4.9.0 , < 4.9.0.107 (custom) Affected: 4.9.26 , < 4.9.26.37 (custom) Affected: 4.9.27 , < 4.9.27.24 (custom) Affected: 4.10.9 , < 4.10.9.77 (custom) Unaffected: 4.10.42 , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:52:09.688697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:02:14.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.354",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.458",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.99",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.379",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.265",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.205",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.115",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.79",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.374",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.403",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.423",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.383",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.430",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.256",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.257",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.134",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity:org.wso2.carbon.identity.authenticator.saml2.sso.ui",
"product": "SAML2 SSO Authenticator UI Bundle",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.5.0.2",
"status": "affected",
"version": "5.5.0",
"versionType": "custom"
},
{
"lessThan": "5.5.2.5",
"status": "affected",
"version": "5.5.2",
"versionType": "custom"
},
{
"lessThan": "5.5.9.4",
"status": "affected",
"version": "5.5.9",
"versionType": "custom"
},
{
"lessThan": "5.5.10.1",
"status": "affected",
"version": "5.5.10",
"versionType": "custom"
},
{
"lessThan": "5.6.4.1",
"status": "affected",
"version": "5.6.4",
"versionType": "custom"
},
{
"lessThan": "5.7.2.1",
"status": "affected",
"version": "5.7.2",
"versionType": "custom"
},
{
"lessThan": "5.8.3.1",
"status": "affected",
"version": "5.8.3",
"versionType": "custom"
},
{
"lessThan": "5.8.7.2",
"status": "affected",
"version": "5.8.7",
"versionType": "custom"
},
{
"lessThan": "5.9.4.2",
"status": "affected",
"version": "5.9.4",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.9.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.ui",
"product": "WSO2 Carbon UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.6.0.2300",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.165",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.3.46",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.28",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.79",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.50",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.107",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.37",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.24",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.10.9.77",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.42",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.354",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.458",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.99",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.379",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.265",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.205",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.115",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.79",
"versionStartIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.374",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.403",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.423",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.383",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.430",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.256",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.257",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.134",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.0.2",
"versionStartIncluding": "5.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.2.5",
"versionStartIncluding": "5.5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.9.4",
"versionStartIncluding": "5.5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.10.1",
"versionStartIncluding": "5.5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.4.1",
"versionStartIncluding": "5.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.7.2.1",
"versionStartIncluding": "5.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.8.3.1",
"versionStartIncluding": "5.8.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.8.7.2",
"versionStartIncluding": "5.8.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.4.2",
"versionStartIncluding": "5.9.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "5.9.9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.2300",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.165",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.46",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.28",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.79",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.50",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.107",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.37",
"versionStartIncluding": "4.9.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.27.24",
"versionStartIncluding": "4.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.77",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.10.42",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Huong Kieu"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products.\u0026nbsp;\u003cspan\u003eExploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products.\u00a0Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product."
}
],
"impacts": [
{
"capecId": "CAPEC-610",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-610 Server-Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:02:55.649Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4050",
"discovery": "EXTERNAL"
},
"title": "Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-14260",
"datePublished": "2026-10-28T19:21:32.066Z",
"dateReserved": "2025-12-08T08:07:33.949Z",
"dateUpdated": "2026-11-03T11:02:55.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-7478 (GCVE-0-2024-7478)
Vulnerability from nvd – Published: 2026-10-21 13:49 – Updated: 2026-10-30 17:57
VLAI
EPSS
VEX
Title
Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
Summary
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.
The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:57 UTC
CWE
- CWE-204 - Indicator Discrepancies
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.310 (custom) Affected: 3.2.0 , < 3.2.0.401 (custom) Affected: 3.2.1 , < 3.2.1.26 (custom) Affected: 4.0.0 , < 4.0.0.318 (custom) Affected: 4.1.0 , < 4.1.0.180 (custom) Affected: 4.2.0 , < 4.2.0.119 (custom) Affected: 4.3.0 , < 4.3.0.30 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.320 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.326 (custom) Affected: 6.0.0 , < 6.0.0.214 (custom) Affected: 6.1.0 , < 6.1.0.198 (custom) Affected: 7.0.0 , < 7.0.0.67 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.371 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.351 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carborn Identity Handler |
Affected:
1.4.0 , < 1.4.0.15
(custom)
Affected: 1.4.0 , < 1.4.0.16 (custom) Affected: 1.4.11 , < 1.4.11.14 (custom) Affected: 1.4.37 , < 1.4.37.1 (custom) Affected: 1.6.1 , < 1.6.1.5 (custom) Affected: 1.7.1 , < 1.7.1.1 (custom) Affected: 1.8.6 , < 1.8.6.5 (custom) Affected: 1.8.14 , < 1.8.14.1 (custom) Affected: 1.9.2 , < 1.9.2.4 (custom) cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:57:13.765575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:57:30.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.310",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.401",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.26",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.318",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.180",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.119",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.30",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.320",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.326",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.214",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.198",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.67",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.371",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.351",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.handler.event.account.lock",
"product": "WSO2 Carborn Identity Handler",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.4.0.15",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.4.0.16",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.4.11.14",
"status": "affected",
"version": "1.4.11",
"versionType": "custom"
},
{
"lessThan": "1.4.37.1",
"status": "affected",
"version": "1.4.37",
"versionType": "custom"
},
{
"lessThan": "1.6.1.5",
"status": "affected",
"version": "1.6.1",
"versionType": "custom"
},
{
"lessThan": "1.7.1.1",
"status": "affected",
"version": "1.7.1",
"versionType": "custom"
},
{
"lessThan": "1.8.6.5",
"status": "affected",
"version": "1.8.6",
"versionType": "custom"
},
{
"lessThan": "1.8.14.1",
"status": "affected",
"version": "1.8.14",
"versionType": "custom"
},
{
"lessThan": "1.9.2.4",
"status": "affected",
"version": "1.9.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.310",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.401",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.26",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.318",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.180",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.119",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.30",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.320",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.326",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.214",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.198",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.67",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.371",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.351",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.0.15",
"versionStartIncluding": "1.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.0.16",
"versionStartIncluding": "1.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.11.14",
"versionStartIncluding": "1.4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.37.1",
"versionStartIncluding": "1.4.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.1.5",
"versionStartIncluding": "1.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.7.1.1",
"versionStartIncluding": "1.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.6.5",
"versionStartIncluding": "1.8.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.14.1",
"versionStartIncluding": "1.8.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.2.4",
"versionStartIncluding": "1.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.\n\nThe discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization\u0027s reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions."
}
],
"value": "When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.\n\nThe discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization\u0027s reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions."
}
],
"impacts": [
{
"capecId": "CAPEC-24",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-24 CAPEC-24: Username Enumeration"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Indicator Discrepancies",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:49:07.839Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3606",
"discovery": "INTERNAL"
},
"title": "Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-7478",
"datePublished": "2026-10-21T13:49:07.839Z",
"dateReserved": "2024-08-05T07:38:19.343Z",
"dateUpdated": "2026-10-30T17:57:30.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-6423 (GCVE-0-2024-6423)
Vulnerability from nvd – Published: 2026-10-21 13:56 – Updated: 2026-10-30 15:11
VLAI
EPSS
VEX
Title
Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
Summary
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.
If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:11 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.313 (custom) Affected: 3.2.0 , < 3.2.0.406 (custom) Affected: 3.2.1 , < 3.2.1.30 (custom) Affected: 4.0.0 , < 4.0.0.324 (custom) Affected: 4.1.0 , < 4.1.0.185 (custom) Affected: 4.2.0 , < 4.2.0.124 (custom) Affected: 4.3.0 , < 4.3.0.36 (custom) Affected: 4.4.0 , < 4.4.0.2 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.363 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.337 (custom) Affected: 5.11.0 , < 5.11.0.384 (custom) Affected: 6.0.0 , < 6.0.0.213 (custom) Affected: 6.1.0 , < 6.1.0.211 (custom) Affected: 7.0.0 , < 7.0.0.50 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.329 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.381 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Application |
Affected:
6.3.0 , < 6.3.0.18
(custom)
Affected: 6.3.11 , < 6.3.11.23 (custom) Affected: 6.3.58 , < 6.3.58.1 (custom) Affected: 6.5.0 , < 6.5.0.5 (custom) Affected: 6.6.0 , < 6.6.0.1 (custom) Affected: 6.7.8 , < 6.7.8.4 (custom) Affected: 6.7.32 , < 6.7.32.1 (custom) Unaffected: x , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Core |
Affected:
5.17.5 , < 5.17.5.286
(custom)
Affected: 5.17.118 , < 5.17.118.11 (custom) Affected: 5.18.187 , < 5.18.187.263 (custom) Affected: 5.18.248 , < 5.18.248.23 (custom) Affected: 5.23.8 , < 5.23.8.189 (custom) Affected: 5.24.8 , < 5.24.8.12 (custom) Affected: 5.25.92 , < 5.25.92.91 (custom) Affected: 5.25.92 , < 5.25.92.118 (custom) Affected: 5.25.705 , < 5.25.705.11 (custom) Affected: 5.25.713 , < 5.25.713.2 (custom) Affected: 7.0.78 , < 7.0.78.27 (custom) Unaffected: x , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Oauth |
Affected:
6.4.2 , < 6.4.2.142
(custom)
Affected: 6.4.176 , < 6.4.176.20 (custom) Affected: 6.4.180 , < 6.4.180.8 (custom) Affected: 6.8.0 , < 6.8.0.40 (custom) Affected: 6.9.6 , < 6.9.6.16 (custom) Affected: 6.11.21 , < 6.11.21.44 (custom) Affected: 6.13.16 , < 6.13.16.6 (custom) Affected: 6.13.19 , < 6.13.19.2 (custom) Affected: 7.0.26 , < 7.0.26.18 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:11:01.346786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:11:58.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.313",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.406",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.30",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.324",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.185",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.124",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.36",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.2",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.363",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.337",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.384",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.213",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.211",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.50",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.329",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.381",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.application.authenticator.basicauth",
"product": "WSO2 Carbon Identity Application",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.3.0.18",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"lessThan": "6.3.11.23",
"status": "affected",
"version": "6.3.11",
"versionType": "custom"
},
{
"lessThan": "6.3.58.1",
"status": "affected",
"version": "6.3.58",
"versionType": "custom"
},
{
"lessThan": "6.5.0.5",
"status": "affected",
"version": "6.5.0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.1",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
},
{
"lessThan": "6.7.8.4",
"status": "affected",
"version": "6.7.8",
"versionType": "custom"
},
{
"lessThan": "6.7.32.1",
"status": "affected",
"version": "6.7.32",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.core",
"product": "WSO2 Carbon Identity Core",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.17.5.286",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.11",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.263",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.23",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.189",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.12",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.91",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.92.118",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.11",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "5.25.713.2",
"status": "affected",
"version": "5.25.713",
"versionType": "custom"
},
{
"lessThan": "7.0.78.27",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.oauth.common",
"product": "WSO2 Carbon Identity Oauth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.142",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.176.20",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.8",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.40",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.16",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.44",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.6",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.2",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "7.0.26.18",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.313",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.406",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.30",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.324",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.185",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.124",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.36",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.2",
"versionStartIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.363",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.337",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.384",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.213",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.211",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.50",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.329",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.381",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.0.18",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.11.23",
"versionStartIncluding": "6.3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.58.1",
"versionStartIncluding": "6.3.58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.0.5",
"versionStartIncluding": "6.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.1",
"versionStartIncluding": "6.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.8.4",
"versionStartIncluding": "6.7.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.32.1",
"versionStartIncluding": "6.7.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "x",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.286",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.11",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.263",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.23",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.189",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.12",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.91",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.118",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.11",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.713.2",
"versionStartIncluding": "5.25.713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.27",
"versionStartIncluding": "7.0.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "x",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.142",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.20",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.8",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.40",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.16",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.44",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.6",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.2",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.18",
"versionStartIncluding": "7.0.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
}
],
"value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
}
],
"impacts": [
{
"capecId": "CAPEC-246",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-246 CAPEC-246: Data Transmission"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:59:54.562Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3465",
"discovery": "INTERNAL"
},
"title": "Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-6423",
"datePublished": "2026-10-21T13:56:26.552Z",
"dateReserved": "2024-07-01T08:23:45.912Z",
"dateUpdated": "2026-10-30T15:11:58.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5139 (GCVE-0-2024-5139)
Vulnerability from nvd – Published: 2026-10-21 13:36 – Updated: 2026-10-30 17:06
VLAI
EPSS
VEX
Title
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
Summary
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:06 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
| https://github.com/wso2/carbon-identity-framework… | patch |
| https://github.com/wso2/carbon-identity-framework… | patch |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.204 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.310 (custom) Affected: 6.0.0 , < 6.0.0.212 (custom) Affected: 6.1.0 , < 6.1.0.195 (custom) Affected: 7.0.0 , < 7.0.0.64 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.286 (custom) Affected: 3.2.0 , < 3.2.0.376 (custom) Affected: 3.2.1 , < 3.2.1.10 (custom) Affected: 4.0.0 , < 4.0.0.299 (custom) Affected: 4.1.0 , < 4.1.0.159 (custom) Affected: 4.2.0 , < 4.2.0.91 (custom) Affected: 4.3.0 , < 4.3.0.6 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.336 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.306 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.357 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon User Management UI |
Affected:
5.14.127 , < 5.14.127.6
(custom)
Affected: 5.17.5 , < 5.17.5.273 (custom) Affected: 5.17.118 , < 5.17.118.3 (custom) Affected: 5.18.187 , < 5.18.187.260 (custom) Affected: 5.18.248 , < 5.18.248.12 (custom) Affected: 5.23.8 , < 5.23.8.191 (custom) Affected: 5.24.8 , < 5.24.8.3 (custom) Affected: 5.25.92 , < 5.25.92.99 (custom) Affected: 5.25.705 , < 5.25.705.3 (custom) Affected: 7.0.78 , < 7.0.78.43 (custom) cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5139",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:06:15.721074Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:06:32.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.204",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.310",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.212",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.195",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.64",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.286",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.376",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.10",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.299",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.159",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.91",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.6",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.336",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.306",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.357",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.user.mgt.ui",
"product": "WSO2 Carbon User Management UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.14.127.6",
"status": "affected",
"version": "5.14.127",
"versionType": "custom"
},
{
"lessThan": "5.17.5.273",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.3",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.260",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.12",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.191",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.3",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.99",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.3",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "7.0.78.43",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.204",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.310",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.212",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.195",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.64",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.286",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.376",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.10",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.299",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.159",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.91",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.6",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.336",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.306",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.357",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.127.6",
"versionStartIncluding": "5.14.127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.273",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.3",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.260",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.12",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.191",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.3",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.99",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.3",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.43",
"versionStartIncluding": "7.0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.\n\nSuccessful exploitation allows an attacker to redirect the user\u0027s browser to a malicious website, modify the web page\u0027s user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible."
}
],
"value": "The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.\n\nSuccessful exploitation allows an attacker to redirect the user\u0027s browser to a malicious website, modify the web page\u0027s user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 CAPEC-21: Cross-Site Scripting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:36:49.246Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-identity-framework/pull/5740"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-identity-framework/pull/5741"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3382",
"discovery": "INTERNAL"
},
"title": "Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-5139",
"datePublished": "2026-10-21T13:36:49.246Z",
"dateReserved": "2024-05-20T06:56:53.376Z",
"dateUpdated": "2026-10-30T17:06:32.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-2323 (GCVE-0-2024-2323)
Vulnerability from nvd – Published: 2026-10-20 07:46 – Updated: 2026-10-20 19:17
VLAI
EPSS
VEX
Title
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
Summary
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.
Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:17 UTC
CWE
- CWE-307 - Improper Restriction of Operations within the Bounds of a Null-Bounded Resource
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.204 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.286 (custom) Affected: 5.11.0 , < 5.11.0.344 (custom) Affected: 6.0.0 , < 6.0.0.188 (custom) Affected: 6.1.0 , < 6.1.0.150 (custom) Affected: 7.0.0 , < 7.0.0.35 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.268 (custom) Affected: 3.2.0 , < 3.2.0.354 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.315 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.283 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.335 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon User Manager Kernel |
Affected:
4.5.0 , < 4.5.0.4
(custom)
Affected: 4.5.3 , < 4.5.3.34 (custom) Affected: 4.6.0 , < 4.6.0.137 (custom) Affected: 4.6.1 , < 4.6.1.111 (custom) Affected: 4.7.1 , < 4.7.1.51 (custom) Affected: 4.9.0 , < 4.9.0.54 (custom) Affected: 4.10.9 , < 4.10.9.20 (custom) cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:17:36.492711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:17:46.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.204",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.286",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.344",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.188",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.150",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.35",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.268",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.354",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.315",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.283",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.335",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.user.core",
"product": "WSO2 Carbon User Manager Kernel",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.4",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.5.3.34",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.137",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.111",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.7.1.51",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.54",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.10.9.20",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.204",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.286",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.344",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.188",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.150",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.35",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.268",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.354",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.315",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.283",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.335",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.4",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.34",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.137",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.111",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.51",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.54",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.20",
"versionStartIncluding": "4.10.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.\n\nExploiting this vulnerability enables an attacker to discover a user\u0027s password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user\u0027s password, with simpler passwords increasing the likelihood of compromise."
}
],
"value": "The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.\n\nExploiting this vulnerability enables an attacker to discover a user\u0027s password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user\u0027s password, with simpler passwords increasing the likelihood of compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-10",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-10 CAPEC-10: Brute Force"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Operations within the Bounds of a Null-Bounded Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T07:46:37.171Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3217",
"discovery": "INTERNAL"
},
"title": "Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-2323",
"datePublished": "2026-10-20T07:46:37.171Z",
"dateReserved": "2024-03-08T13:40:56.654Z",
"dateUpdated": "2026-10-20T19:17:46.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13173 (GCVE-0-2025-13173)
Vulnerability from nvd – Published: 2026-10-19 16:49 – Updated: 2026-10-20 19:31
VLAI
EPSS
VEX
Title
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
Summary
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the "Revoke token upon user logout" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.
This vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:31 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.47 (custom) Affected: 4.6.0 , < 4.6.0.13 (custom) cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.46 (custom) Affected: 4.6.0 , < 4.6.0.11 (custom) cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.352 (custom) Affected: 3.2.0 , < 3.2.0.456 (custom) Affected: 3.2.1 , < 3.2.1.81 (custom) Affected: 4.0.0 , < 4.0.0.376 (custom) Affected: 4.1.0 , < 4.1.0.246 (custom) Affected: 4.2.0 , < 4.2.0.186 (custom) Affected: 4.3.0 , < 4.3.0.97 (custom) Affected: 4.4.0 , < 4.4.0.61 (custom) Affected: 4.5.0 , < 4.5.0.46 (custom) Affected: 4.6.0 , < 4.6.0.11 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.45 (custom) Affected: 4.6.0 , < 4.6.0.11 (custom) cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.372 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.421 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.401 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.381 (custom) Affected: 5.11.0 , < 5.11.0.428 (custom) Affected: 6.0.0 , < 6.0.0.255 (custom) Affected: 6.1.0 , < 6.1.0.256 (custom) Affected: 7.0.0 , < 7.0.0.133 (custom) Affected: 7.1.0 , < 7.1.0.41 (custom) Affected: 7.2.0 , < 7.2.0.3 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon OAuth |
Affected:
6.4.2 , < 6.4.2.171
(custom)
Affected: 6.4.111 , < 6.4.111.165 (custom) Affected: 6.4.176 , < 6.4.176.30 (custom) Affected: 6.4.180 , < 6.4.180.14 (custom) Affected: 6.8.0 , < 6.8.0.54 (custom) Affected: 6.9.6 , < 6.9.6.29 (custom) Affected: 6.11.21 , < 6.11.21.94 (custom) Affected: 6.13.16 , < 6.13.16.21 (custom) Affected: 6.13.19 , < 6.13.19.14 (custom) Affected: 6.13.27 , < 6.13.27.10 (custom) Affected: 6.13.41 , < 6.13.41.1 (custom) Affected: 7.0.26 , < 7.0.26.87 (custom) Affected: 7.0.259 , < 7.0.259.34 (custom) Affected: 7.0.385 , < 7.0.385.3 (custom) cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13173",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:31:38.155765Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:31:45.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.47",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.13",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.46",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.11",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.352",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.456",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.81",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.376",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.246",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.186",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.97",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.61",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.46",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.11",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.45",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.11",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.372",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.421",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.401",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.381",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.428",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.255",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.256",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.133",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.41",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
},
{
"lessThan": "7.2.0.3",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"product": "WSO2 Carbon OAuth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.171",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.111.165",
"status": "affected",
"version": "6.4.111",
"versionType": "custom"
},
{
"lessThan": "6.4.176.30",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.14",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.54",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.29",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.94",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.21",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.14",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "6.13.27.10",
"status": "affected",
"version": "6.13.27",
"versionType": "custom"
},
{
"lessThan": "6.13.41.1",
"status": "affected",
"version": "6.13.41",
"versionType": "custom"
},
{
"lessThan": "7.0.26.87",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
},
{
"lessThan": "7.0.259.34",
"status": "affected",
"version": "7.0.259",
"versionType": "custom"
},
{
"lessThan": "7.0.385.3",
"status": "affected",
"version": "7.0.385",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.47",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.13",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.46",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.11",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.352",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.456",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.81",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.376",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.246",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.186",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.97",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.61",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.46",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.11",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.45",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.11",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.372",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.421",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.401",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.381",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.428",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.255",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.256",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.133",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0.41",
"versionStartIncluding": "7.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.0.3",
"versionStartIncluding": "7.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.171",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.111.165",
"versionStartIncluding": "6.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.30",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.14",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.54",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.29",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.94",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.21",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.14",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.27.10",
"versionStartIncluding": "6.13.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.41.1",
"versionStartIncluding": "6.13.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.87",
"versionStartIncluding": "7.0.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.259.34",
"versionStartIncluding": "7.0.259",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.385.3",
"versionStartIncluding": "7.0.385",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the \"Revoke token upon user logout\" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.\n\nThis vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data."
}
],
"value": "Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound token feature is enabled with token binding validation and the \"Revoke token upon user logout\" option is not active. The software fails to automatically invalidate session-bound tokens upon user session termination.\n\nThis vulnerability exists when token binding validation is enabled. As a result, a malicious actor possessing a valid session-bound token could exploit this condition to maintain unauthorized access to applications and resources even after the associated user session has ended, potentially leading to the exposure of sensitive user data."
}
],
"impacts": [
{
"capecId": "CAPEC-276",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-276 CAPEC-276: Session Token Interception"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:49:08.687Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4727",
"discovery": "INTERNAL"
},
"title": "Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-13173",
"datePublished": "2026-10-19T16:49:08.687Z",
"dateReserved": "2025-11-14T10:17:18.989Z",
"dateUpdated": "2026-10-20T19:31:45.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-10149 (GCVE-0-2025-10149)
Vulnerability from nvd – Published: 2026-10-19 16:40 – Updated: 2026-10-20 19:29
VLAI
EPSS
VEX
Title
Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
Summary
The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.
A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:29 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.370 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.419 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.379 (custom) Affected: 5.11.0 , < 5.11.0.415 (custom) Affected: 6.0.0 , < 6.0.0.251 (custom) Affected: 6.1.0 , < 6.1.0.251 (custom) Affected: 7.0.0 , < 7.0.0.127 (custom) Affected: 7.1.0 , < 7.1.0.34 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon SCIM Common Component |
Affected:
5.6.0 , < 5.6.0.1
(custom)
Affected: 5.6.1 , < 5.6.1.2 (custom) Affected: 5.7.0 , < 5.7.0.3 (custom) Affected: 5.7.1 , < 5.7.1.1 (custom) Affected: 5.7.7 , < 5.7.7.1 (custom) Affected: 5.7.8 , < 5.7.8.1 (custom) cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon SCIM 2.0 Common Component |
Affected:
1.5.1 , < 1.5.1.40
(custom)
Affected: 1.5.46 , < 1.5.46.47 (custom) cpe:2.3:a:wso2:wso2_carbon_scim_2.0_common_component:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_scim_2.0_common_component:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:29:42.886456Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:29:50.753Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.370",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.419",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.379",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.415",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.251",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.251",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.127",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.34",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.provisioning.scim:org.wso2.carbon.identity.scim.common",
"product": "WSO2 Carbon SCIM Common Component",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.6.0.1",
"status": "affected",
"version": "5.6.0",
"versionType": "custom"
},
{
"lessThan": "5.6.1.2",
"status": "affected",
"version": "5.6.1",
"versionType": "custom"
},
{
"lessThan": "5.7.0.3",
"status": "affected",
"version": "5.7.0",
"versionType": "custom"
},
{
"lessThan": "5.7.1.1",
"status": "affected",
"version": "5.7.1",
"versionType": "custom"
},
{
"lessThan": "5.7.7.1",
"status": "affected",
"version": "5.7.7",
"versionType": "custom"
},
{
"lessThan": "5.7.8.1",
"status": "affected",
"version": "5.7.8",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.provisioning.scim2:org.wso2.carbon.identity.scim2.common",
"product": "WSO2 Carbon SCIM 2.0 Common Component",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.5.1.40",
"status": "affected",
"version": "1.5.1",
"versionType": "custom"
},
{
"lessThan": "1.5.46.47",
"status": "affected",
"version": "1.5.46",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.370",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.419",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.379",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.415",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.251",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.251",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.127",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0.34",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.0.1",
"versionStartIncluding": "5.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.1.2",
"versionStartIncluding": "5.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.7.0.3",
"versionStartIncluding": "5.7.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.7.1.1",
"versionStartIncluding": "5.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.7.7.1",
"versionStartIncluding": "5.7.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.7.8.1",
"versionStartIncluding": "5.7.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_2.0_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.1.40",
"versionStartIncluding": "1.5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_scim_2.0_common_component:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.5.46.47",
"versionStartIncluding": "1.5.46",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.\n\nA malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity."
}
],
"value": "The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations.\n\nA malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity."
}
],
"impacts": [
{
"capecId": "CAPEC-10",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-10 CAPEC-10: Access Control"
}
]
},
{
"capecId": "CAPEC-61",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-61 CAPEC-61: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281: Improper Security Management",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-668",
"description": "CWE-668: Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:40:26.522Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4438/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4438/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4438/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4438/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4438",
"discovery": "INTERNAL"
},
"title": "Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-10149",
"datePublished": "2026-10-19T16:40:26.522Z",
"dateReserved": "2025-09-09T06:03:06.474Z",
"dateUpdated": "2026-10-20T19:29:50.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-4412 (GCVE-0-2024-4412)
Vulnerability from nvd – Published: 2026-10-19 16:59 – Updated: 2026-10-20 19:31
VLAI
EPSS
VEX
Title
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
Summary
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.
Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:31 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
5 references
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.205 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.276 (custom) Affected: 3.2.0 , < 3.2.0.366 (custom) Affected: 3.2.1 , < 3.2.1.18 (custom) Affected: 4.0.0 , < 4.0.0.307 (custom) Affected: 4.1.0 , < 4.1.0.169 (custom) Affected: 4.2.0 , < 4.2.0.108 (custom) Affected: 4.3.0 , < 4.3.0.20 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.346 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.297 (custom) Affected: 5.11.0 , < 5.11.0.337 (custom) Affected: 6.0.0 , < 6.0.0.189 (custom) Affected: 6.1.0 , < 6.1.0.149 (custom) Affected: 7.0.0 , < 7.0.0.15 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.293 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.326 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity User Store Configuration UI |
Affected:
5.14.127 , < 5.14.127.8
(custom)
Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity User Store Configuration |
Affected:
5.14.127 , < 5.14.127.8
(custom)
Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Recovery Management |
Affected:
1.4.72 , < 1.4.72.66
(custom)
Affected: 1.4.100 , < 1.4.100.6 (custom) Affected: 1.7.2 , < 1.7.2.2 (custom) Affected: 1.8.107 , < 1.8.107.1 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Application Authentication Framework |
Affected:
5.18.248 , < 5.18.248.20
(custom)
Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity User Store |
Affected:
1.0.190 , < 1.0.190.14
(custom)
Affected: 1.2.3 , < 1.2.3.4 (custom) Affected: 1.2.23 , < 1.2.23.4 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:31:18.482516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:31:26.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.205",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.276",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.366",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.18",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.307",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.169",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.108",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.20",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.346",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.297",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.337",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.189",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.149",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.15",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.293",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.326",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
"product": "WSO2 Carbon Identity User Store Configuration UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.14.127.8",
"status": "affected",
"version": "5.14.127",
"versionType": "custom"
},
{
"lessThan": "5.17.5.266",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.6",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.253",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.20",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.178",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.9",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.81",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.8",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "7.0.78.12",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.user.store.configuration",
"product": "WSO2 Carbon Identity User Store Configuration",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.14.127.8",
"status": "affected",
"version": "5.14.127",
"versionType": "custom"
},
{
"lessThan": "5.17.5.266",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.6",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.253",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.20",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.178",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.9",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.81",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.8",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "7.0.78.12",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
"product": "WSO2 Carbon Identity Recovery Management",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.4.72.66",
"status": "affected",
"version": "1.4.72",
"versionType": "custom"
},
{
"lessThan": "1.4.100.6",
"status": "affected",
"version": "1.4.100",
"versionType": "custom"
},
{
"lessThan": "1.7.2.2",
"status": "affected",
"version": "1.7.2",
"versionType": "custom"
},
{
"lessThan": "1.8.107.1",
"status": "affected",
"version": "1.8.107",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
"product": "WSO2 Carbon Identity Application Authentication Framework",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.18.248.20",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.24.8.9",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.705.8",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
"product": "WSO2 Carbon Identity User Store",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.190.14",
"status": "affected",
"version": "1.0.190",
"versionType": "custom"
},
{
"lessThan": "1.2.3.4",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.23.4",
"status": "affected",
"version": "1.2.23",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.205",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.276",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.366",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.18",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.307",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.169",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.108",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.20",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.346",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.297",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.337",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.189",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.149",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.15",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.293",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.326",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.127.8",
"versionStartIncluding": "5.14.127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.266",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.6",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.253",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.20",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.178",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.9",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.81",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.8",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.12",
"versionStartIncluding": "7.0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.127.8",
"versionStartIncluding": "5.14.127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.266",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.6",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.253",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.20",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.178",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.9",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.81",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.8",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.12",
"versionStartIncluding": "7.0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.72.66",
"versionStartIncluding": "1.4.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.100.6",
"versionStartIncluding": "1.4.100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.7.2.2",
"versionStartIncluding": "1.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.107.1",
"versionStartIncluding": "1.8.107",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.20",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.9",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.8",
"versionStartIncluding": "5.25.705",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.190.14",
"versionStartIncluding": "1.0.190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.3.4",
"versionStartIncluding": "1.2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.23.4",
"versionStartIncluding": "1.2.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
}
],
"value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
}
],
"impacts": [
{
"capecId": "CAPEC-22",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-22 CAPEC-22: Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:59:05.004Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2-extensions/identity-governance/pull/848"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-identity-framework/pull/5895"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/identity-apps/pull/6829"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/product-apim/pull/13524"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution"
}
],
"source": {
"advisory": "WSO2-2023-3098",
"discovery": "INTERNAL"
},
"title": "Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-4412",
"datePublished": "2026-10-19T16:59:05.004Z",
"dateReserved": "2024-05-02T08:55:58.638Z",
"dateUpdated": "2026-10-20T19:31:26.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1397 (GCVE-0-2025-1397)
Vulnerability from cvelistv5 – Published: 2026-11-03 06:07 – Updated: 2026-11-03 20:03
VLAI
EPSS
VEX
Title
Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
Summary
When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.
A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 20:03 UTC
CWE
- CWE-862 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.10
(custom)
cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.10
(custom)
cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.321 (custom) Affected: 3.2.0 , < 3.2.0.414 (custom) Affected: 3.2.1 , < 3.2.1.50 (custom) Affected: 4.0.0 , < 4.0.0.335 (custom) Affected: 4.1.0 , < 4.1.0.211 (custom) Affected: 4.2.0 , < 4.2.0.150 (custom) Affected: 4.3.0 , < 4.3.0.63 (custom) Affected: 4.4.0 , < 4.4.0.26 (custom) Affected: 4.5.0 , < 4.5.0.10 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.11
(custom)
cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.346 (custom) Affected: 5.11.0 , < 5.11.0.396 (custom) Affected: 6.0.0 , < 6.0.0.232 (custom) Affected: 6.1.0 , < 6.1.0.224 (custom) Affected: 7.0.0 , < 7.0.0.93 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.370 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.390 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.339 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon OAuth |
Affected:
6.4.2 , < 6.4.2.155
(custom)
Affected: 6.4.111 , < 6.4.111.134 (custom) Affected: 6.4.176 , < 6.4.176.25 (custom) Affected: 6.4.180 , < 6.4.180.11 (custom) Affected: 6.8.0 , < 6.8.0.49 (custom) Affected: 6.9.6 , < 6.9.6.22 (custom) Affected: 6.11.21 , < 6.11.21.75 (custom) Affected: 6.13.16 , < 6.13.16.15 (custom) Affected: 6.13.19 , < 6.13.19.9 (custom) Affected: 6.13.27 , < 6.13.27.2 (custom) Affected: 7.0.26 , < 7.0.26.58 (custom) cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* |
|
| WSO2 | JWT Grant Type For OAuth2 |
Affected:
1.0.26 , < 1.0.26.6
(custom)
Affected: 1.0.26 , < 1.0.26.7 (custom) Affected: 1.0.31 , < 1.0.31.3 (custom) Affected: 1.1.0 , < 1.1.0.2 (custom) Affected: 2.0.4 , < 2.0.4.3 (custom) Affected: 2.1.1 , < 2.1.1.2 (custom) Affected: 2.2.0 , < 2.2.0.3 (custom) Affected: 2.2.4 , < 2.2.4.1 (custom) Affected: 2.3.1 , < 2.3.1.4 (custom) cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1397",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T20:03:01.670683Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T20:03:19.304Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.321",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.414",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.50",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.335",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.211",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.150",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.63",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.26",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.346",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.396",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.232",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.224",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.93",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.370",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.390",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.339",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"product": "WSO2 Carbon OAuth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.155",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.111.134",
"status": "affected",
"version": "6.4.111",
"versionType": "custom"
},
{
"lessThan": "6.4.176.25",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.11",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.49",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.22",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.75",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.15",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.9",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "6.13.27.2",
"status": "affected",
"version": "6.13.27",
"versionType": "custom"
},
{
"lessThan": "7.0.26.58",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.extension.identity.oauth2.grantType.jwt:org.wso2.carbon.identity.oauth2.grant.jwt",
"product": "JWT Grant Type For OAuth2",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.26.6",
"status": "affected",
"version": "1.0.26",
"versionType": "custom"
},
{
"lessThan": "1.0.26.7",
"status": "affected",
"version": "1.0.26",
"versionType": "custom"
},
{
"lessThan": "1.0.31.3",
"status": "affected",
"version": "1.0.31",
"versionType": "custom"
},
{
"lessThan": "1.1.0.2",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThan": "2.0.4.3",
"status": "affected",
"version": "2.0.4",
"versionType": "custom"
},
{
"lessThan": "2.1.1.2",
"status": "affected",
"version": "2.1.1",
"versionType": "custom"
},
{
"lessThan": "2.2.0.3",
"status": "affected",
"version": "2.2.0",
"versionType": "custom"
},
{
"lessThan": "2.2.4.1",
"status": "affected",
"version": "2.2.4",
"versionType": "custom"
},
{
"lessThan": "2.3.1.4",
"status": "affected",
"version": "2.3.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.321",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.414",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.50",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.335",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.211",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.150",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.63",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.26",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.346",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.396",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.232",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.224",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.93",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.370",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.390",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.339",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.155",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.111.134",
"versionStartIncluding": "6.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.25",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.11",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.49",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.22",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.75",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.15",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.9",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.27.2",
"versionStartIncluding": "6.13.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.58",
"versionStartIncluding": "7.0.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.26.6",
"versionStartIncluding": "1.0.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.26.7",
"versionStartIncluding": "1.0.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.31.3",
"versionStartIncluding": "1.0.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.1.0.2",
"versionStartIncluding": "1.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.4.3",
"versionStartIncluding": "2.0.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.1.1.2",
"versionStartIncluding": "2.1.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.0.3",
"versionStartIncluding": "2.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.4.1",
"versionStartIncluding": "2.2.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:jwt_grant_type_for_oauth2:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.1.4",
"versionStartIncluding": "2.3.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.\n\nA malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP\u0027s disabled state."
}
],
"value": "When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled.\n\nA malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP\u0027s disabled state."
}
],
"impacts": [
{
"capecId": "CAPEC-346",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-346 CAPEC-346: Token Generation/Distribution Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T06:07:57.302Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4010/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4010",
"discovery": "INTERNAL"
},
"title": "Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-1397",
"datePublished": "2026-11-03T06:07:57.302Z",
"dateReserved": "2025-02-17T14:31:46.349Z",
"dateUpdated": "2026-11-03T20:03:19.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-12139 (GCVE-0-2024-12139)
Vulnerability from cvelistv5 – Published: 2026-11-02 17:34 – Updated: 2026-11-02 19:10
VLAI
EPSS
VEX
Title
Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
Summary
The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.
By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:09 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.2.1
(custom)
Affected: 3.2.1 , < 3.2.1.49 (custom) Affected: 4.1.0 , < 4.1.0.210 (custom) Affected: 4.2.0 , < 4.2.0.148 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.346 (custom) Affected: 5.11.0 , < 5.11.0.385 (custom) Affected: 6.0.0 , < 6.0.0.229 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.339 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-12139",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:09:36.270401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:10:02.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.2.1",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.49",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.210",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.148",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.346",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.385",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.229",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.339",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.49",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.210",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.148",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.346",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.385",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.229",
"versionStartIncluding": "6.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.339",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions."
}
],
"value": "The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions."
}
],
"impacts": [
{
"capecId": "CAPEC-148",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-148 Content Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:34:20.302Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3805",
"discovery": "INTERNAL"
},
"title": "Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-12139",
"datePublished": "2026-11-02T17:34:20.302Z",
"dateReserved": "2024-12-04T10:21:25.665Z",
"dateUpdated": "2026-11-02T19:10:02.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-9517 (GCVE-0-2024-9517)
Vulnerability from cvelistv5 – Published: 2026-11-02 11:30 – Updated: 2026-11-02 16:55
VLAI
EPSS
VEX
Title
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
Summary
The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.
This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:55 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.308 (custom) Affected: 3.2.0 , < 3.2.0.429 (custom) Affected: 3.2.1 , < 3.2.1.49 (custom) Affected: 4.0.0 , < 4.0.0.315 (custom) Affected: 4.1.0 , < 4.1.0.214 (custom) Affected: 4.2.0 , < 4.2.0.149 (custom) Affected: 4.3.0 , < 4.3.0.62 (custom) Affected: 4.4.0 , < 4.4.0.25 (custom) Affected: 4.5.0 , < 4.5.0.9 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.9
(custom)
cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.9
(custom)
cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.10
(custom)
cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.324 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.331 (custom) Affected: 5.11.0 , < 5.11.0.376 (custom) Affected: 6.0.0 , < 6.0.0.219 (custom) Affected: 6.1.0 , < 6.1.0.205 (custom) Affected: 7.0.0 , < 7.0.0.73 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.357 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.377 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon OAuth |
Affected:
6.4.2 , < 6.4.2.148
(custom)
Affected: 6.4.111 , < 6.4.111.122 (custom) Affected: 6.4.176 , < 6.4.176.26 (custom) Affected: 6.4.180 , < 6.4.180.10 (custom) Affected: 6.8.0 , < 6.8.0.44 (custom) Affected: 6.9.6 , < 6.9.6.21 (custom) Affected: 6.11.21 , < 6.11.21.64 (custom) Affected: 6.13.16 , < 6.13.16.13 (custom) Affected: 6.13.19 , < 6.13.19.7 (custom) Affected: 6.13.27 , < 6.13.27.1 (custom) Affected: 7.0.26 , < 7.0.26.37 (custom) cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-9517",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:55:20.360718Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:55:34.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.308",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.429",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.49",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.315",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.214",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.149",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.62",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.25",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.9",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.9",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.9",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.10",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.324",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.331",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.376",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.219",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.205",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.73",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.357",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.377",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"product": "WSO2 Carbon OAuth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.148",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.111.122",
"status": "affected",
"version": "6.4.111",
"versionType": "custom"
},
{
"lessThan": "6.4.176.26",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.10",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.44",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.21",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.64",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.13",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.7",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "6.13.27.1",
"status": "affected",
"version": "6.13.27",
"versionType": "custom"
},
{
"lessThan": "7.0.26.37",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.308",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.429",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.49",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.315",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.214",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.149",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.62",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.25",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.9",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.9",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.9",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.10",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.324",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.331",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.376",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.219",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.205",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.73",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.357",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.377",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.148",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.111.122",
"versionStartIncluding": "6.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.26",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.10",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.44",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.21",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.64",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.13",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.7",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.27.1",
"versionStartIncluding": "6.13.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.37",
"versionStartIncluding": "7.0.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.\n\nThis vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account."
}
],
"value": "The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms.\n\nThis vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account."
}
],
"impacts": [
{
"capecId": "CAPEC-24",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-24 CAPEC-24: Session Fixation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T11:30:15.562Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3676/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3676",
"discovery": "INTERNAL"
},
"title": "Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-9517",
"datePublished": "2026-11-02T11:30:15.562Z",
"dateReserved": "2024-10-04T07:58:59.333Z",
"dateUpdated": "2026-11-02T16:55:34.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-2372 (GCVE-0-2024-2372)
Vulnerability from cvelistv5 – Published: 2026-11-02 11:00 – Updated: 2026-11-02 16:57
VLAI
EPSS
VEX
Title
Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
Summary
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:56 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.383 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.0.0
(custom)
Affected: 3.0.0 , < 3.0.0.160 (custom) Affected: 3.1.0 , < 3.1.0.335 (custom) Affected: 3.2.0 , < 3.2.0.432 (custom) Affected: 3.2.1 , < 3.2.1.51 (custom) Affected: 4.0.0 , < 4.0.0.310 (custom) Affected: 4.1.0 , < 4.1.0.208 (custom) Affected: 4.2.0 , < 4.2.0.146 (custom) Affected: 4.3.0 , < 4.3.0.59 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.9.0
(custom)
Affected: 5.9.0 , < 5.9.0.163 (custom) Affected: 5.10.0 , < 5.10.0.355 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.404 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.212 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.9.0
(custom)
Affected: 5.9.0 , < 5.9.0.154 (custom) Affected: 5.10.0 , < 5.10.0.291 (custom) Affected: 5.11.0 , < 5.11.0.371 (custom) Affected: 6.0.0 , < 6.0.0.178 (custom) Affected: 6.1.0 , < 6.1.0.134 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Registry Kernel |
Affected:
4.5.1 , < 4.5.1.36
(custom)
Affected: 4.5.3 , < 4.5.3.36 (custom) Affected: 4.6.0 , < 4.6.0.139 (custom) Affected: 4.6.0 , < 4.6.0.1544 (custom) Affected: 4.6.1 , < 4.6.1.105 (custom) Affected: 4.6.2 , < 4.6.2.321 (custom) Affected: 4.6.3 , < 4.6.3.28 (custom) Affected: 4.6.4 , < 4.6.4.11 (custom) Affected: 4.7.1 , < 4.7.1.47 (custom) Affected: 4.8.1 , < 4.8.1.27 (custom) Affected: 4.8.1 , < 4.8.1.31 (custom) Affected: 4.9.0 , < 4.9.0.46 (custom) Affected: 4.9.26 , < 4.9.26.18 (custom) cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2372",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:56:50.364469Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:57:01.300Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.383",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.0.0.160",
"status": "affected",
"version": "3.0.0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.335",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.432",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.51",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.310",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.208",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.146",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.59",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.9.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.9.0.163",
"status": "affected",
"version": "5.9.0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.355",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.404",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.212",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.9.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.9.0.154",
"status": "affected",
"version": "5.9.0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.291",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.371",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.178",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.134",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.registry.core",
"product": "WSO2 Carbon Registry Kernel",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.1.36",
"status": "affected",
"version": "4.5.1",
"versionType": "custom"
},
{
"lessThan": "4.5.3.36",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.139",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.1544",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.105",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.321",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.28",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.11",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.47",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.27",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.31",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.46",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.18",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.383",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.0.0.160",
"versionStartIncluding": "3.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.335",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.432",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.51",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.310",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.208",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.146",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.59",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.0.163",
"versionStartIncluding": "5.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.355",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.404",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.212",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.0.154",
"versionStartIncluding": "5.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.291",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.371",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.178",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.134",
"versionStartIncluding": "6.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.1.36",
"versionStartIncluding": "4.5.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.36",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.139",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.1544",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.105",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.2.321",
"versionStartIncluding": "4.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.28",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.11",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.47",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.27",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.31",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.46",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.18",
"versionStartIncluding": "4.9.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm."
}
],
"value": "The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm."
}
],
"impacts": [
{
"capecId": "CAPEC-603",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-603 CAPEC-603: Open Redirect"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T11:00:23.105Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3254",
"discovery": "INTERNAL"
},
"title": "Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-2372",
"datePublished": "2026-11-02T11:00:23.105Z",
"dateReserved": "2024-03-11T13:20:39.998Z",
"dateUpdated": "2026-11-02T16:57:01.300Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18800 (GCVE-0-2026-18800)
Vulnerability from cvelistv5 – Published: 2026-11-02 09:59 – Updated: 2026-11-02 17:10
VLAI
EPSS
VEX
Title
Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
Summary
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.
A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.
Severity
4.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 17:09 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.357 (custom) Affected: 3.2.0 , < 3.2.0.465 (custom) Affected: 3.2.1 , < 3.2.1.84 (custom) Affected: 4.1.0 , < 4.1.0.249 (custom) Affected: 4.2.0 , < 4.2.0.189 (custom) Affected: 4.3.0 , < 4.3.0.100 (custom) Affected: 4.4.0 , < 4.4.0.64 (custom) Affected: 4.5.0 , < 4.5.0.49 (custom) Affected: 4.6.0 , < 4.6.0.13 (custom) |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.48 (custom) Affected: 4.6.0 , < 4.6.0.13 (custom) |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.50 (custom) Affected: 4.6.0 , < 4.6.0.14 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.49 (custom) Affected: 4.6.0 , < 4.6.0.13 (custom) |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.386 (custom) Affected: 5.11.0 , < 5.11.0.433 (custom) Affected: 6.0.0 , < 6.0.0.260 (custom) Affected: 6.1.0 , < 6.1.0.261 (custom) Affected: 7.0.0 , < 7.0.0.139 (custom) Affected: 7.1.0 , < 7.1.0.47 (custom) Affected: 7.2.0 , < 7.2.0.8 (custom) |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.377 (custom) |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.426 (custom) |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.406 (custom) |
|
| WSO2 | WSO2 Carbon Event Publisher Core |
Affected:
0 , < 5.2.65
(custom)
Affected: 5.3.0 , < 5.3.28 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18800",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T17:09:46.475225Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T17:10:08.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.357",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.465",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.84",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.249",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.189",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.100",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.64",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.49",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.13",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.48",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.13",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.50",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.14",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.49",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.13",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.386",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.433",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.260",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.261",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.139",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.47",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
},
{
"lessThan": "7.2.0.8",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.377",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.426",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.406",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.core",
"product": "WSO2 Carbon Event Publisher Core",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.2.65",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.3.28",
"status": "affected",
"version": "5.3.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.\n\nA malicious actor with access to the \u0027wso2carbon\u0027 log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets."
}
],
"value": "When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property.\n\nA malicious actor with access to the \u0027wso2carbon\u0027 log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets."
}
],
"impacts": [
{
"capecId": "CAPEC-116",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-116: Excavation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T09:59:26.522Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4897",
"discovery": "INTERNAL"
},
"title": "Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-18800",
"datePublished": "2026-11-02T09:59:26.522Z",
"dateReserved": "2026-08-04T11:14:13.708Z",
"dateUpdated": "2026-11-02T17:10:08.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13647 (GCVE-0-2025-13647)
Vulnerability from cvelistv5 – Published: 2026-11-02 09:20 – Updated: 2026-11-02 19:20
VLAI
EPSS
VEX
Title
Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
Summary
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.
Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:20 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.381 (custom) Affected: 5.11.0 , < 5.11.0.428 (custom) Affected: 6.0.0 , < 6.0.0.255 (custom) Affected: 6.1.0 , < 6.1.0.255 (custom) Affected: 7.0.0 , < 7.0.0.133 (custom) Affected: 7.1.0 , < 7.1.0.41 (custom) Affected: 7.2.0 , < 7.2.0.3 (custom) |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.421 (custom) |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.372 (custom) |
|
| WSO2 | WSO2 Identity Server Keystore Rest API Commons |
Affected:
1.0.82 , < 1.0.82.25
(custom)
Affected: 1.0.190 , < 1.0.190.17 (custom) Affected: 1.2.3 , < 1.2.3.6 (custom) Affected: 1.2.23 , < 1.2.23.10 (custom) Affected: 1.2.176 , < 1.2.176.18 (custom) Affected: 1.3.83 , < 1.3.83.10 (custom) Affected: 1.3.213 , < 1.3.213.1 (custom) Unaffected: 1.3.221 , ≤ * (custom) |
|
| WSO2 | WSO2 Identity Server Keystore Rest API V1 |
Affected:
1.0.82 , < 1.0.82.25
(custom)
Affected: 1.0.190 , < 1.0.190.17 (custom) Affected: 1.2.3 , < 1.2.3.6 (custom) Affected: 1.2.23 , < 1.2.23.10 (custom) Affected: 1.2.176 , < 1.2.176.18 (custom) Affected: 1.3.83 , < 1.3.83.10 (custom) Affected: 1.3.213 , < 1.3.213.1 (custom) Unaffected: 1.3.221 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13647",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:20:07.726881Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:20:26.022Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.381",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.428",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.255",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.255",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.133",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.41",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
},
{
"lessThan": "7.2.0.3",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.421",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.372",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.api.server.keystore.management.common",
"product": "WSO2 Identity Server Keystore Rest API Commons",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.82.25",
"status": "affected",
"version": "1.0.82",
"versionType": "custom"
},
{
"lessThan": "1.0.190.17",
"status": "affected",
"version": "1.0.190",
"versionType": "custom"
},
{
"lessThan": "1.2.3.6",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.23.10",
"status": "affected",
"version": "1.2.23",
"versionType": "custom"
},
{
"lessThan": "1.2.176.18",
"status": "affected",
"version": "1.2.176",
"versionType": "custom"
},
{
"lessThan": "1.3.83.10",
"status": "affected",
"version": "1.3.83",
"versionType": "custom"
},
{
"lessThan": "1.3.213.1",
"status": "affected",
"version": "1.3.213",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.3.221",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.server.api:org.wso2.carbon.identity.api.server.keystore.management.v1",
"product": "WSO2 Identity Server Keystore Rest API V1",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.82.25",
"status": "affected",
"version": "1.0.82",
"versionType": "custom"
},
{
"lessThan": "1.0.190.17",
"status": "affected",
"version": "1.0.190",
"versionType": "custom"
},
{
"lessThan": "1.2.3.6",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.23.10",
"status": "affected",
"version": "1.2.23",
"versionType": "custom"
},
{
"lessThan": "1.2.176.18",
"status": "affected",
"version": "1.2.176",
"versionType": "custom"
},
{
"lessThan": "1.3.83.10",
"status": "affected",
"version": "1.3.83",
"versionType": "custom"
},
{
"lessThan": "1.3.213.1",
"status": "affected",
"version": "1.3.213",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.3.221",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.\n\nSuccessful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system."
}
],
"value": "The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header.\n\nSuccessful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system."
}
],
"impacts": [
{
"capecId": "CAPEC-173",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-173 CAPEC-173: Information Gathering"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T09:20:52.186Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4751",
"discovery": "INTERNAL"
},
"title": "Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-13647",
"datePublished": "2026-11-02T09:20:52.186Z",
"dateReserved": "2025-11-25T09:37:21.342Z",
"dateUpdated": "2026-11-02T19:20:26.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11969 (GCVE-0-2025-11969)
Vulnerability from cvelistv5 – Published: 2026-11-02 05:53 – Updated: 2026-11-02 19:41
VLAI
EPSS
VEX
Title
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
Summary
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.
Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 19:41 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.347 (custom) Affected: 3.2.0 , < 3.2.0.450 (custom) Affected: 3.2.1 , < 3.2.1.70 (custom) Affected: 4.0.0 , < 4.0.0.370 (custom) Affected: 4.1.0 , < 4.1.0.233 (custom) Affected: 4.2.0 , < 4.2.0.173 (custom) Affected: 4.3.0 , < 4.3.0.85 (custom) Affected: 4.4.0 , < 4.4.0.49 (custom) Affected: 4.5.0 , < 4.5.0.32 (custom) |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.367 (custom) |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.396 (custom) |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.416 (custom) |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.33 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.31 (custom) |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.31 (custom) |
|
| WSO2 | WSO2 Carbon API Manager Rest API Utility |
Affected:
6.6.163 , < 6.6.163.159
(custom)
Affected: 6.6.163 , < 6.6.163.160 (custom) Affected: 6.7.206 , < 6.7.206.574 (custom) Affected: 6.7.206 , < 6.7.206.576 (custom) Affected: 6.7.210 , < 6.7.210.69 (custom) Affected: 6.7.210 , < 6.7.210.71 (custom) Affected: 9.0.174 , < 9.0.174.536 (custom) Affected: 9.20.74 , < 9.20.74.384 (custom) Affected: 9.20.74 , < 9.20.74.385 (custom) Affected: 9.28.116 , < 9.28.116.380 (custom) Affected: 9.29.120 , < 9.29.120.202 (custom) Affected: 9.30.67 , < 9.30.67.125 (custom) Affected: 9.31.86 , < 9.31.86.90 (custom) Unaffected: 9.32.147 , ≤ * (custom) |
|
| WSO2 | WSO2 Carbon API Manager Rest API Common Functions |
Affected:
9.0.174 , < 9.0.174.538
(custom)
Affected: 9.20.74 , < 9.20.74.385 (custom) Affected: 9.28.116 , < 9.28.116.382 (custom) Affected: 9.29.120 , < 9.29.120.204 (custom) Affected: 9.30.67 , < 9.30.67.126 (custom) Affected: 9.31.86 , < 9.31.86.91 (custom) Unaffected: 9.32.147 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-11969",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T19:41:02.813424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T19:41:15.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.347",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.450",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.70",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.370",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.233",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.173",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.85",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.49",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.32",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.367",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.396",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.416",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.33",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.31",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.31",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
"product": "WSO2 Carbon API Manager Rest API Utility",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.163.159",
"status": "affected",
"version": "6.6.163",
"versionType": "custom"
},
{
"lessThan": "6.6.163.160",
"status": "affected",
"version": "6.6.163",
"versionType": "custom"
},
{
"lessThan": "6.7.206.574",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.206.576",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.210.69",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "6.7.210.71",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "9.0.174.536",
"status": "affected",
"version": "9.0.174",
"versionType": "custom"
},
{
"lessThan": "9.20.74.384",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.20.74.385",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.380",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.202",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.125",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.90",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.147",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.common",
"product": "WSO2 Carbon API Manager Rest API Common Functions",
"vendor": "WSO2",
"versions": [
{
"lessThan": "9.0.174.538",
"status": "affected",
"version": "9.0.174",
"versionType": "custom"
},
{
"lessThan": "9.20.74.385",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.382",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.204",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.126",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.91",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.147",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager\u0027s API Gateway are not affected by this vulnerability."
}
],
"value": "The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product.\n\nSuccessful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager\u0027s API Gateway are not affected by this vulnerability."
}
],
"impacts": [
{
"capecId": "CAPEC-10",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-10 CAPEC-10: Access Control"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T05:53:51.375Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4733/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4733",
"discovery": "INTERNAL"
},
"title": "Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-11969",
"datePublished": "2026-11-02T05:53:51.375Z",
"dateReserved": "2025-10-20T15:28:50.917Z",
"dateUpdated": "2026-11-02T19:41:15.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3583 (GCVE-0-2026-3583)
Vulnerability from cvelistv5 – Published: 2026-10-28 19:21 – Updated: 2026-10-29 02:02
VLAI
EPSS
VEX
Title
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
Summary
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.
The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:51 UTC
CWE
- CWE-613 - Insufficient Session Expiration
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
9 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.367 (custom) Affected: 3.2.0 , < 3.2.0.475 (custom) Affected: 3.2.1 , < 3.2.1.106 (custom) Affected: 4.0.0 , < 4.0.0.394 (custom) Affected: 4.1.0 , < 4.1.0.267 (custom) Affected: 4.2.0 , < 4.2.0.207 (custom) Affected: 4.3.0 , < 4.3.0.120 (custom) Affected: 4.4.0 , < 4.4.0.83 (custom) Affected: 4.5.0 , < 4.5.0.67 (custom) Affected: 4.6.0 , < 4.6.0.29 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.65 (custom) Affected: 4.6.0 , < 4.6.0.29 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.67 (custom) Affected: 4.6.0 , < 4.6.0.29 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.68 (custom) Affected: 4.6.0 , < 4.6.0.30 (custom) Affected: 4.7.0 , < 4.7.0.3 (custom) cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.397 (custom) Affected: 5.11.0 , < 5.11.0.444 (custom) Affected: 6.0.0 , < 6.0.0.270 (custom) Affected: 6.1.0 , < 6.1.0.269 (custom) Affected: 7.0.0 , < 7.0.0.152 (custom) Affected: 7.1.0 , < 7.1.0.61 (custom) Affected: 7.2.0 , < 7.2.0.20 (custom) Affected: 7.3.0 , < 7.3.0.1 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.434 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.387 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.414 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon OAuth |
Affected:
6.4.2 , < 6.4.2.178
(custom)
Affected: 6.4.111 , < 6.4.111.174 (custom) Affected: 6.4.176 , < 6.4.176.38 (custom) Affected: 6.4.180 , < 6.4.180.25 (custom) Affected: 6.8.0 , < 6.8.0.59 (custom) Affected: 6.9.6 , < 6.9.6.36 (custom) Affected: 6.11.21 , < 6.11.21.118 (custom) Affected: 6.13.16 , < 6.13.16.32 (custom) Affected: 6.13.19 , < 6.13.19.23 (custom) Affected: 6.13.27 , < 6.13.27.21 (custom) Affected: 6.13.41 , < 6.13.41.9 (custom) Affected: 6.14.14 , < 6.14.14.3 (custom) Affected: 7.0.26 , < 7.0.26.103 (custom) Affected: 7.0.259 , < 7.0.259.54 (custom) Affected: 7.0.385 , < 7.0.385.15 (custom) Affected: 7.4.99 , < 7.4.99.5 (custom) Unaffected: 7.5.78 , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3583",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:51:44.830935Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:02:14.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.367",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.475",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.106",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.394",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.267",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.207",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.120",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.83",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.67",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.29",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.65",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.29",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.67",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.29",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.68",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.30",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.7.0.3",
"status": "affected",
"version": "4.7.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.397",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.444",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.270",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.269",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.152",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.61",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
},
{
"lessThan": "7.2.0.20",
"status": "affected",
"version": "7.2.0",
"versionType": "custom"
},
{
"lessThan": "7.3.0.1",
"status": "affected",
"version": "7.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.434",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.387",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.414",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth",
"product": "WSO2 Carbon OAuth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.178",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.111.174",
"status": "affected",
"version": "6.4.111",
"versionType": "custom"
},
{
"lessThan": "6.4.176.38",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.25",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.59",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.36",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.118",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.32",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.23",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "6.13.27.21",
"status": "affected",
"version": "6.13.27",
"versionType": "custom"
},
{
"lessThan": "6.13.41.9",
"status": "affected",
"version": "6.13.41",
"versionType": "custom"
},
{
"lessThan": "6.14.14.3",
"status": "affected",
"version": "6.14.14",
"versionType": "custom"
},
{
"lessThan": "7.0.26.103",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
},
{
"lessThan": "7.0.259.54",
"status": "affected",
"version": "7.0.259",
"versionType": "custom"
},
{
"lessThan": "7.0.385.15",
"status": "affected",
"version": "7.0.385",
"versionType": "custom"
},
{
"lessThan": "7.4.99.5",
"status": "affected",
"version": "7.4.99",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.5.78",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.367",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.475",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.106",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.394",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.267",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.207",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.120",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.83",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.67",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.29",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.65",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.29",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.67",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.29",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.68",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.30",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.0.3",
"versionStartIncluding": "4.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.397",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.444",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.270",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.269",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.152",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0.61",
"versionStartIncluding": "7.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.0.20",
"versionStartIncluding": "7.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.0.1",
"versionStartIncluding": "7.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.434",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.387",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.414",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.178",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.111.174",
"versionStartIncluding": "6.4.111",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.38",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.25",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.59",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.36",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.118",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.32",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.23",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.27.21",
"versionStartIncluding": "6.13.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.41.9",
"versionStartIncluding": "6.13.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.14.14.3",
"versionStartIncluding": "6.14.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.103",
"versionStartIncluding": "7.0.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.259.54",
"versionStartIncluding": "7.0.259",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.385.15",
"versionStartIncluding": "7.0.385",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4.99.5",
"versionStartIncluding": "7.4.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_oauth:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "7.5.78",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.\n\nThe security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows."
}
],
"value": "When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.\n\nThe security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows."
}
],
"impacts": [
{
"capecId": "CAPEC-250",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-250 CAPEC-250: Session Fixation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-613",
"description": "CWE-613: Insufficient Session Expiration",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T19:21:34.577Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/#solution"
}
],
"source": {
"advisory": "WSO2-2026-5175",
"discovery": "INTERNAL"
},
"title": "Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-3583",
"datePublished": "2026-10-28T19:21:34.577Z",
"dateReserved": "2026-03-05T02:24:55.645Z",
"dateUpdated": "2026-10-29T02:02:14.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14260 (GCVE-0-2025-14260)
Vulnerability from cvelistv5 – Published: 2026-10-28 19:21 – Updated: 2026-11-03 11:02
VLAI
EPSS
VEX
Title
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
Summary
Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 01:52 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.354 (custom) Affected: 3.2.0 , < 3.2.0.458 (custom) Affected: 3.2.1 , < 3.2.1.99 (custom) Affected: 4.0.0 , < 4.0.0.379 (custom) Affected: 4.1.0 , < 4.1.0.265 (custom) Affected: 4.2.0 , < 4.2.0.205 (custom) Affected: 4.3.0 , < 4.3.0.115 (custom) Affected: 4.4.0 , < 4.4.0.79 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.374 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.403 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.423 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.383 (custom) Affected: 5.11.0 , < 5.11.0.430 (custom) Affected: 6.0.0 , < 6.0.0.256 (custom) Affected: 6.1.0 , < 6.1.0.257 (custom) Affected: 7.0.0 , < 7.0.0.134 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | SAML2 SSO Authenticator UI Bundle |
Affected:
5.5.0 , < 5.5.0.2
(custom)
Affected: 5.5.2 , < 5.5.2.5 (custom) Affected: 5.5.9 , < 5.5.9.4 (custom) Affected: 5.5.10 , < 5.5.10.1 (custom) Affected: 5.6.4 , < 5.6.4.1 (custom) Affected: 5.7.2 , < 5.7.2.1 (custom) Affected: 5.8.3 , < 5.8.3.1 (custom) Affected: 5.8.7 , < 5.8.7.2 (custom) Affected: 5.9.4 , < 5.9.4.2 (custom) Unaffected: 5.9.9 , ≤ * (custom) cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon UI |
Affected:
4.6.0 , < 4.6.0.2300
(custom)
Affected: 4.6.1 , < 4.6.1.165 (custom) Affected: 4.6.3 , < 4.6.3.46 (custom) Affected: 4.6.4 , < 4.6.4.28 (custom) Affected: 4.7.1 , < 4.7.1.79 (custom) Affected: 4.8.1 , < 4.8.1.50 (custom) Affected: 4.9.0 , < 4.9.0.107 (custom) Affected: 4.9.26 , < 4.9.26.37 (custom) Affected: 4.9.27 , < 4.9.27.24 (custom) Affected: 4.10.9 , < 4.10.9.77 (custom) Unaffected: 4.10.42 , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T01:52:09.688697Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T02:02:14.426Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.354",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.458",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.99",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.379",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.265",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.205",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.115",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.79",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.374",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.403",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.423",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.383",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.430",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.256",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.257",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.134",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity:org.wso2.carbon.identity.authenticator.saml2.sso.ui",
"product": "SAML2 SSO Authenticator UI Bundle",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.5.0.2",
"status": "affected",
"version": "5.5.0",
"versionType": "custom"
},
{
"lessThan": "5.5.2.5",
"status": "affected",
"version": "5.5.2",
"versionType": "custom"
},
{
"lessThan": "5.5.9.4",
"status": "affected",
"version": "5.5.9",
"versionType": "custom"
},
{
"lessThan": "5.5.10.1",
"status": "affected",
"version": "5.5.10",
"versionType": "custom"
},
{
"lessThan": "5.6.4.1",
"status": "affected",
"version": "5.6.4",
"versionType": "custom"
},
{
"lessThan": "5.7.2.1",
"status": "affected",
"version": "5.7.2",
"versionType": "custom"
},
{
"lessThan": "5.8.3.1",
"status": "affected",
"version": "5.8.3",
"versionType": "custom"
},
{
"lessThan": "5.8.7.2",
"status": "affected",
"version": "5.8.7",
"versionType": "custom"
},
{
"lessThan": "5.9.4.2",
"status": "affected",
"version": "5.9.4",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "5.9.9",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.ui",
"product": "WSO2 Carbon UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.6.0.2300",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.165",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.3.46",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.28",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.79",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.50",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.107",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.37",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.24",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.10.9.77",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.42",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.354",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.458",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.99",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.379",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.265",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.205",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.115",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.79",
"versionStartIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.374",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.403",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.423",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.383",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.430",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.256",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.257",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.134",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.0.2",
"versionStartIncluding": "5.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.2.5",
"versionStartIncluding": "5.5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.9.4",
"versionStartIncluding": "5.5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.5.10.1",
"versionStartIncluding": "5.5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.4.1",
"versionStartIncluding": "5.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.7.2.1",
"versionStartIncluding": "5.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.8.3.1",
"versionStartIncluding": "5.8.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.8.7.2",
"versionStartIncluding": "5.8.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.9.4.2",
"versionStartIncluding": "5.9.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:saml2_sso_authenticator_ui_bundle:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "5.9.9",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.2300",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.165",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.46",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.28",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.79",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.50",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.107",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.37",
"versionStartIncluding": "4.9.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.27.24",
"versionStartIncluding": "4.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.77",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_ui:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.10.42",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Huong Kieu"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products.\u0026nbsp;\u003cspan\u003eExploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products.\u00a0Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product."
}
],
"impacts": [
{
"capecId": "CAPEC-610",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-610 Server-Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T11:02:55.649Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4050/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4050",
"discovery": "EXTERNAL"
},
"title": "Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-14260",
"datePublished": "2026-10-28T19:21:32.066Z",
"dateReserved": "2025-12-08T08:07:33.949Z",
"dateUpdated": "2026-11-03T11:02:55.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-6423 (GCVE-0-2024-6423)
Vulnerability from cvelistv5 – Published: 2026-10-21 13:56 – Updated: 2026-10-30 15:11
VLAI
EPSS
VEX
Title
Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
Summary
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.
If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 15:11 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.313 (custom) Affected: 3.2.0 , < 3.2.0.406 (custom) Affected: 3.2.1 , < 3.2.1.30 (custom) Affected: 4.0.0 , < 4.0.0.324 (custom) Affected: 4.1.0 , < 4.1.0.185 (custom) Affected: 4.2.0 , < 4.2.0.124 (custom) Affected: 4.3.0 , < 4.3.0.36 (custom) Affected: 4.4.0 , < 4.4.0.2 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.363 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.337 (custom) Affected: 5.11.0 , < 5.11.0.384 (custom) Affected: 6.0.0 , < 6.0.0.213 (custom) Affected: 6.1.0 , < 6.1.0.211 (custom) Affected: 7.0.0 , < 7.0.0.50 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.329 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.381 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Application |
Affected:
6.3.0 , < 6.3.0.18
(custom)
Affected: 6.3.11 , < 6.3.11.23 (custom) Affected: 6.3.58 , < 6.3.58.1 (custom) Affected: 6.5.0 , < 6.5.0.5 (custom) Affected: 6.6.0 , < 6.6.0.1 (custom) Affected: 6.7.8 , < 6.7.8.4 (custom) Affected: 6.7.32 , < 6.7.32.1 (custom) Unaffected: x , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Core |
Affected:
5.17.5 , < 5.17.5.286
(custom)
Affected: 5.17.118 , < 5.17.118.11 (custom) Affected: 5.18.187 , < 5.18.187.263 (custom) Affected: 5.18.248 , < 5.18.248.23 (custom) Affected: 5.23.8 , < 5.23.8.189 (custom) Affected: 5.24.8 , < 5.24.8.12 (custom) Affected: 5.25.92 , < 5.25.92.91 (custom) Affected: 5.25.92 , < 5.25.92.118 (custom) Affected: 5.25.705 , < 5.25.705.11 (custom) Affected: 5.25.713 , < 5.25.713.2 (custom) Affected: 7.0.78 , < 7.0.78.27 (custom) Unaffected: x , ≤ * (custom) cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Oauth |
Affected:
6.4.2 , < 6.4.2.142
(custom)
Affected: 6.4.176 , < 6.4.176.20 (custom) Affected: 6.4.180 , < 6.4.180.8 (custom) Affected: 6.8.0 , < 6.8.0.40 (custom) Affected: 6.9.6 , < 6.9.6.16 (custom) Affected: 6.11.21 , < 6.11.21.44 (custom) Affected: 6.13.16 , < 6.13.16.6 (custom) Affected: 6.13.19 , < 6.13.19.2 (custom) Affected: 7.0.26 , < 7.0.26.18 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-6423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T15:11:01.346786Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T15:11:58.008Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.313",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.406",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.30",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.324",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.185",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.124",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.36",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.2",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.363",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.337",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.384",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.213",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.211",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.50",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.329",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.381",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.application.authenticator.basicauth",
"product": "WSO2 Carbon Identity Application",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.3.0.18",
"status": "affected",
"version": "6.3.0",
"versionType": "custom"
},
{
"lessThan": "6.3.11.23",
"status": "affected",
"version": "6.3.11",
"versionType": "custom"
},
{
"lessThan": "6.3.58.1",
"status": "affected",
"version": "6.3.58",
"versionType": "custom"
},
{
"lessThan": "6.5.0.5",
"status": "affected",
"version": "6.5.0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.1",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
},
{
"lessThan": "6.7.8.4",
"status": "affected",
"version": "6.7.8",
"versionType": "custom"
},
{
"lessThan": "6.7.32.1",
"status": "affected",
"version": "6.7.32",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.core",
"product": "WSO2 Carbon Identity Core",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.17.5.286",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.11",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.263",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.23",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.189",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.12",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.91",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.92.118",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.11",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "5.25.713.2",
"status": "affected",
"version": "5.25.713",
"versionType": "custom"
},
{
"lessThan": "7.0.78.27",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "x",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.oauth.common",
"product": "WSO2 Carbon Identity Oauth",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.4.2.142",
"status": "affected",
"version": "6.4.2",
"versionType": "custom"
},
{
"lessThan": "6.4.176.20",
"status": "affected",
"version": "6.4.176",
"versionType": "custom"
},
{
"lessThan": "6.4.180.8",
"status": "affected",
"version": "6.4.180",
"versionType": "custom"
},
{
"lessThan": "6.8.0.40",
"status": "affected",
"version": "6.8.0",
"versionType": "custom"
},
{
"lessThan": "6.9.6.16",
"status": "affected",
"version": "6.9.6",
"versionType": "custom"
},
{
"lessThan": "6.11.21.44",
"status": "affected",
"version": "6.11.21",
"versionType": "custom"
},
{
"lessThan": "6.13.16.6",
"status": "affected",
"version": "6.13.16",
"versionType": "custom"
},
{
"lessThan": "6.13.19.2",
"status": "affected",
"version": "6.13.19",
"versionType": "custom"
},
{
"lessThan": "7.0.26.18",
"status": "affected",
"version": "7.0.26",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.313",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.406",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.30",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.324",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.185",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.124",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.36",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.2",
"versionStartIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.363",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.337",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.384",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.213",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.211",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.50",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.329",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.381",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.0.18",
"versionStartIncluding": "6.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.11.23",
"versionStartIncluding": "6.3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.58.1",
"versionStartIncluding": "6.3.58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.0.5",
"versionStartIncluding": "6.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.1",
"versionStartIncluding": "6.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.8.4",
"versionStartIncluding": "6.7.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.32.1",
"versionStartIncluding": "6.7.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "x",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.286",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.11",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.263",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.23",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.189",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.12",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.91",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.118",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.11",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.713.2",
"versionStartIncluding": "5.25.713",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.27",
"versionStartIncluding": "7.0.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "x",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.2.142",
"versionStartIncluding": "6.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.176.20",
"versionStartIncluding": "6.4.176",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.180.8",
"versionStartIncluding": "6.4.180",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.8.0.40",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.9.6.16",
"versionStartIncluding": "6.9.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.11.21.44",
"versionStartIncluding": "6.11.21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.16.6",
"versionStartIncluding": "6.13.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13.19.2",
"versionStartIncluding": "6.13.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.26.18",
"versionStartIncluding": "7.0.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
}
],
"value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
}
],
"impacts": [
{
"capecId": "CAPEC-246",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-246 CAPEC-246: Data Transmission"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:59:54.562Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3465",
"discovery": "INTERNAL"
},
"title": "Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-6423",
"datePublished": "2026-10-21T13:56:26.552Z",
"dateReserved": "2024-07-01T08:23:45.912Z",
"dateUpdated": "2026-10-30T15:11:58.008Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-7478 (GCVE-0-2024-7478)
Vulnerability from cvelistv5 – Published: 2026-10-21 13:49 – Updated: 2026-10-30 17:57
VLAI
EPSS
VEX
Title
Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
Summary
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.
The discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization's reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:57 UTC
CWE
- CWE-204 - Indicator Discrepancies
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.310 (custom) Affected: 3.2.0 , < 3.2.0.401 (custom) Affected: 3.2.1 , < 3.2.1.26 (custom) Affected: 4.0.0 , < 4.0.0.318 (custom) Affected: 4.1.0 , < 4.1.0.180 (custom) Affected: 4.2.0 , < 4.2.0.119 (custom) Affected: 4.3.0 , < 4.3.0.30 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.320 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.326 (custom) Affected: 6.0.0 , < 6.0.0.214 (custom) Affected: 6.1.0 , < 6.1.0.198 (custom) Affected: 7.0.0 , < 7.0.0.67 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.371 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.351 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carborn Identity Handler |
Affected:
1.4.0 , < 1.4.0.15
(custom)
Affected: 1.4.0 , < 1.4.0.16 (custom) Affected: 1.4.11 , < 1.4.11.14 (custom) Affected: 1.4.37 , < 1.4.37.1 (custom) Affected: 1.6.1 , < 1.6.1.5 (custom) Affected: 1.7.1 , < 1.7.1.1 (custom) Affected: 1.8.6 , < 1.8.6.5 (custom) Affected: 1.8.14 , < 1.8.14.1 (custom) Affected: 1.9.2 , < 1.9.2.4 (custom) cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-7478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:57:13.765575Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:57:30.908Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.310",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.401",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.26",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.318",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.180",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.119",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.30",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.320",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.326",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.214",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.198",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.67",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.371",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.351",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.handler.event.account.lock",
"product": "WSO2 Carborn Identity Handler",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.4.0.15",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.4.0.16",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThan": "1.4.11.14",
"status": "affected",
"version": "1.4.11",
"versionType": "custom"
},
{
"lessThan": "1.4.37.1",
"status": "affected",
"version": "1.4.37",
"versionType": "custom"
},
{
"lessThan": "1.6.1.5",
"status": "affected",
"version": "1.6.1",
"versionType": "custom"
},
{
"lessThan": "1.7.1.1",
"status": "affected",
"version": "1.7.1",
"versionType": "custom"
},
{
"lessThan": "1.8.6.5",
"status": "affected",
"version": "1.8.6",
"versionType": "custom"
},
{
"lessThan": "1.8.14.1",
"status": "affected",
"version": "1.8.14",
"versionType": "custom"
},
{
"lessThan": "1.9.2.4",
"status": "affected",
"version": "1.9.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.310",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.401",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.26",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.318",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.180",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.119",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.30",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.320",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.326",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.214",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.198",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.67",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.371",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.351",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.0.15",
"versionStartIncluding": "1.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.0.16",
"versionStartIncluding": "1.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.11.14",
"versionStartIncluding": "1.4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.37.1",
"versionStartIncluding": "1.4.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.6.1.5",
"versionStartIncluding": "1.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.7.1.1",
"versionStartIncluding": "1.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.6.5",
"versionStartIncluding": "1.8.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.14.1",
"versionStartIncluding": "1.8.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carborn_identity_handler:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.9.2.4",
"versionStartIncluding": "1.9.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.\n\nThe discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization\u0027s reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions."
}
],
"value": "When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the external user store.\n\nThe discovery of valid usernames can increase the risk of targeted brute-force attacks, social engineering, and information leakage. Attackers can leverage this information to craft more convincing phishing campaigns or other social engineering tactics to trick users into revealing sensitive data. The presence of username enumeration could also negatively impact an organization\u0027s reputation, leading to loss of customer trust, regulatory non-compliance, and potential legal and financial repercussions."
}
],
"impacts": [
{
"capecId": "CAPEC-24",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-24 CAPEC-24: Username Enumeration"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-204",
"description": "CWE-204: Indicator Discrepancies",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:49:07.839Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3606",
"discovery": "INTERNAL"
},
"title": "Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-7478",
"datePublished": "2026-10-21T13:49:07.839Z",
"dateReserved": "2024-08-05T07:38:19.343Z",
"dateUpdated": "2026-10-30T17:57:30.908Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-5139 (GCVE-0-2024-5139)
Vulnerability from cvelistv5 – Published: 2026-10-21 13:36 – Updated: 2026-10-30 17:06
VLAI
EPSS
VEX
Title
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
Summary
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.
Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 17:06 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
| https://github.com/wso2/carbon-identity-framework… | patch |
| https://github.com/wso2/carbon-identity-framework… | patch |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.204 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.310 (custom) Affected: 6.0.0 , < 6.0.0.212 (custom) Affected: 6.1.0 , < 6.1.0.195 (custom) Affected: 7.0.0 , < 7.0.0.64 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.286 (custom) Affected: 3.2.0 , < 3.2.0.376 (custom) Affected: 3.2.1 , < 3.2.1.10 (custom) Affected: 4.0.0 , < 4.0.0.299 (custom) Affected: 4.1.0 , < 4.1.0.159 (custom) Affected: 4.2.0 , < 4.2.0.91 (custom) Affected: 4.3.0 , < 4.3.0.6 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.336 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.306 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.357 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon User Management UI |
Affected:
5.14.127 , < 5.14.127.6
(custom)
Affected: 5.17.5 , < 5.17.5.273 (custom) Affected: 5.17.118 , < 5.17.118.3 (custom) Affected: 5.18.187 , < 5.18.187.260 (custom) Affected: 5.18.248 , < 5.18.248.12 (custom) Affected: 5.23.8 , < 5.23.8.191 (custom) Affected: 5.24.8 , < 5.24.8.3 (custom) Affected: 5.25.92 , < 5.25.92.99 (custom) Affected: 5.25.705 , < 5.25.705.3 (custom) Affected: 7.0.78 , < 7.0.78.43 (custom) cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5139",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T17:06:15.721074Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T17:06:32.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.204",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.310",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.212",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.195",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.64",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.286",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.376",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.10",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.299",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.159",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.91",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.6",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.336",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.306",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.357",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.user.mgt.ui",
"product": "WSO2 Carbon User Management UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.14.127.6",
"status": "affected",
"version": "5.14.127",
"versionType": "custom"
},
{
"lessThan": "5.17.5.273",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.3",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.260",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.12",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.191",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.3",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.99",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.3",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "7.0.78.43",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.204",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.310",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.212",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.195",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.64",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.286",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.376",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.10",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.299",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.159",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.91",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.6",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.336",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.306",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.357",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.127.6",
"versionStartIncluding": "5.14.127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.273",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.3",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.260",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.12",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.191",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.3",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.99",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.3",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_management_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.43",
"versionStartIncluding": "7.0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.\n\nSuccessful exploitation allows an attacker to redirect the user\u0027s browser to a malicious website, modify the web page\u0027s user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible."
}
],
"value": "The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.\n\nSuccessful exploitation allows an attacker to redirect the user\u0027s browser to a malicious website, modify the web page\u0027s user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 CAPEC-21: Cross-Site Scripting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T13:36:49.246Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-identity-framework/pull/5740"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-identity-framework/pull/5741"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3382",
"discovery": "INTERNAL"
},
"title": "Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-5139",
"datePublished": "2026-10-21T13:36:49.246Z",
"dateReserved": "2024-05-20T06:56:53.376Z",
"dateUpdated": "2026-10-30T17:06:32.391Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-2323 (GCVE-0-2024-2323)
Vulnerability from cvelistv5 – Published: 2026-10-20 07:46 – Updated: 2026-10-20 19:17
VLAI
EPSS
VEX
Title
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
Summary
The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.
Exploiting this vulnerability enables an attacker to discover a user's password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user's password, with simpler passwords increasing the likelihood of compromise.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:17 UTC
CWE
- CWE-307 - Improper Restriction of Operations within the Bounds of a Null-Bounded Resource
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.204 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.286 (custom) Affected: 5.11.0 , < 5.11.0.344 (custom) Affected: 6.0.0 , < 6.0.0.188 (custom) Affected: 6.1.0 , < 6.1.0.150 (custom) Affected: 7.0.0 , < 7.0.0.35 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.268 (custom) Affected: 3.2.0 , < 3.2.0.354 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.315 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.283 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.335 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon User Manager Kernel |
Affected:
4.5.0 , < 4.5.0.4
(custom)
Affected: 4.5.3 , < 4.5.3.34 (custom) Affected: 4.6.0 , < 4.6.0.137 (custom) Affected: 4.6.1 , < 4.6.1.111 (custom) Affected: 4.7.1 , < 4.7.1.51 (custom) Affected: 4.9.0 , < 4.9.0.54 (custom) Affected: 4.10.9 , < 4.10.9.20 (custom) cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-2323",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:17:36.492711Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:17:46.609Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.204",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.286",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.344",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.188",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.150",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.35",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.268",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.354",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.315",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.283",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.335",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.user.core",
"product": "WSO2 Carbon User Manager Kernel",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.4",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.5.3.34",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.137",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.111",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.7.1.51",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.54",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.10.9.20",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.204",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.286",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.344",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.188",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.150",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.35",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.268",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.354",
"versionStartIncluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.315",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.283",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.335",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.4",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.34",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.137",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.111",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.51",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.54",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_user_manager_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.20",
"versionStartIncluding": "4.10.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.\n\nExploiting this vulnerability enables an attacker to discover a user\u0027s password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user\u0027s password, with simpler passwords increasing the likelihood of compromise."
}
],
"value": "The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted.\n\nExploiting this vulnerability enables an attacker to discover a user\u0027s password through brute force, leading to account impersonation. The success rate of such an attack is influenced by the complexity of the targeted user\u0027s password, with simpler passwords increasing the likelihood of compromise."
}
],
"impacts": [
{
"capecId": "CAPEC-10",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-10 CAPEC-10: Brute Force"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-307",
"description": "CWE-307: Improper Restriction of Operations within the Bounds of a Null-Bounded Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T07:46:37.171Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3217/#solution"
}
],
"source": {
"advisory": "WSO2-2024-3217",
"discovery": "INTERNAL"
},
"title": "Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-2323",
"datePublished": "2026-10-20T07:46:37.171Z",
"dateReserved": "2024-03-08T13:40:56.654Z",
"dateUpdated": "2026-10-20T19:17:46.609Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-4412 (GCVE-0-2024-4412)
Vulnerability from cvelistv5 – Published: 2026-10-19 16:59 – Updated: 2026-10-20 19:31
VLAI
EPSS
VEX
Title
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
Summary
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.
Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-20 19:31 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
5 references
Impacted products
11 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.205 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.276 (custom) Affected: 3.2.0 , < 3.2.0.366 (custom) Affected: 3.2.1 , < 3.2.1.18 (custom) Affected: 4.0.0 , < 4.0.0.307 (custom) Affected: 4.1.0 , < 4.1.0.169 (custom) Affected: 4.2.0 , < 4.2.0.108 (custom) Affected: 4.3.0 , < 4.3.0.20 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.346 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.297 (custom) Affected: 5.11.0 , < 5.11.0.337 (custom) Affected: 6.0.0 , < 6.0.0.189 (custom) Affected: 6.1.0 , < 6.1.0.149 (custom) Affected: 7.0.0 , < 7.0.0.15 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.293 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.326 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity User Store Configuration UI |
Affected:
5.14.127 , < 5.14.127.8
(custom)
Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity User Store Configuration |
Affected:
5.14.127 , < 5.14.127.8
(custom)
Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Recovery Management |
Affected:
1.4.72 , < 1.4.72.66
(custom)
Affected: 1.4.100 , < 1.4.100.6 (custom) Affected: 1.7.2 , < 1.7.2.2 (custom) Affected: 1.8.107 , < 1.8.107.1 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity Application Authentication Framework |
Affected:
5.18.248 , < 5.18.248.20
(custom)
Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Identity User Store |
Affected:
1.0.190 , < 1.0.190.14
(custom)
Affected: 1.2.3 , < 1.2.3.4 (custom) Affected: 1.2.23 , < 1.2.23.4 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-4412",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-20T19:31:18.482516Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T19:31:26.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.205",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.276",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.366",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.18",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.307",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.169",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.108",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.20",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.346",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.297",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.337",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.189",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.149",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.15",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.293",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.326",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
"product": "WSO2 Carbon Identity User Store Configuration UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.14.127.8",
"status": "affected",
"version": "5.14.127",
"versionType": "custom"
},
{
"lessThan": "5.17.5.266",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.6",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.253",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.20",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.178",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.9",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.81",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.8",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "7.0.78.12",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.user.store.configuration",
"product": "WSO2 Carbon Identity User Store Configuration",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.14.127.8",
"status": "affected",
"version": "5.14.127",
"versionType": "custom"
},
{
"lessThan": "5.17.5.266",
"status": "affected",
"version": "5.17.5",
"versionType": "custom"
},
{
"lessThan": "5.17.118.6",
"status": "affected",
"version": "5.17.118",
"versionType": "custom"
},
{
"lessThan": "5.18.187.253",
"status": "affected",
"version": "5.18.187",
"versionType": "custom"
},
{
"lessThan": "5.18.248.20",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.23.8.178",
"status": "affected",
"version": "5.23.8",
"versionType": "custom"
},
{
"lessThan": "5.24.8.9",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.92.81",
"status": "affected",
"version": "5.25.92",
"versionType": "custom"
},
{
"lessThan": "5.25.705.8",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
},
{
"lessThan": "7.0.78.12",
"status": "affected",
"version": "7.0.78",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
"product": "WSO2 Carbon Identity Recovery Management",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.4.72.66",
"status": "affected",
"version": "1.4.72",
"versionType": "custom"
},
{
"lessThan": "1.4.100.6",
"status": "affected",
"version": "1.4.100",
"versionType": "custom"
},
{
"lessThan": "1.7.2.2",
"status": "affected",
"version": "1.7.2",
"versionType": "custom"
},
{
"lessThan": "1.8.107.1",
"status": "affected",
"version": "1.8.107",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
"product": "WSO2 Carbon Identity Application Authentication Framework",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.18.248.20",
"status": "affected",
"version": "5.18.248",
"versionType": "custom"
},
{
"lessThan": "5.24.8.9",
"status": "affected",
"version": "5.24.8",
"versionType": "custom"
},
{
"lessThan": "5.25.705.8",
"status": "affected",
"version": "5.25.705",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
"product": "WSO2 Carbon Identity User Store",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.0.190.14",
"status": "affected",
"version": "1.0.190",
"versionType": "custom"
},
{
"lessThan": "1.2.3.4",
"status": "affected",
"version": "1.2.3",
"versionType": "custom"
},
{
"lessThan": "1.2.23.4",
"status": "affected",
"version": "1.2.23",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.205",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.276",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.366",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.18",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.307",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.169",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.108",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.20",
"versionStartIncluding": "4.3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.346",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.297",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.337",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.189",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.149",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.15",
"versionStartIncluding": "7.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.293",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.326",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.127.8",
"versionStartIncluding": "5.14.127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.266",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.6",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.253",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.20",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.178",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.9",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.81",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.8",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.12",
"versionStartIncluding": "7.0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.14.127.8",
"versionStartIncluding": "5.14.127",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.5.266",
"versionStartIncluding": "5.17.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.17.118.6",
"versionStartIncluding": "5.17.118",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.187.253",
"versionStartIncluding": "5.18.187",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.20",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.23.8.178",
"versionStartIncluding": "5.23.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.9",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.92.81",
"versionStartIncluding": "5.25.92",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.8",
"versionStartIncluding": "5.25.705",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.78.12",
"versionStartIncluding": "7.0.78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.72.66",
"versionStartIncluding": "1.4.72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.4.100.6",
"versionStartIncluding": "1.4.100",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.7.2.2",
"versionStartIncluding": "1.7.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.8.107.1",
"versionStartIncluding": "1.8.107",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.248.20",
"versionStartIncluding": "5.18.248",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.24.8.9",
"versionStartIncluding": "5.24.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.25.705.8",
"versionStartIncluding": "5.25.705",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.0.190.14",
"versionStartIncluding": "1.0.190",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.3.4",
"versionStartIncluding": "1.2.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.23.4",
"versionStartIncluding": "1.2.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
}
],
"value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
}
],
"impacts": [
{
"capecId": "CAPEC-22",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-22 CAPEC-22: Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:59:05.004Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2-extensions/identity-governance/pull/848"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-identity-framework/pull/5895"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/identity-apps/pull/6829"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/product-apim/pull/13524"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution"
}
],
"source": {
"advisory": "WSO2-2023-3098",
"discovery": "INTERNAL"
},
"title": "Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2024-4412",
"datePublished": "2026-10-19T16:59:05.004Z",
"dateReserved": "2024-05-02T08:55:58.638Z",
"dateUpdated": "2026-10-20T19:31:26.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}