WSO2 API Manager.

Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

• WSO2 API Manager
• WSO2 API Control Plane
• Broken access control

Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification

• WSO2 API Control Plane
• WSO2 API Manager
• Cross-site scripting (XSS)

Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Broken access control

Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

• WSO2 API Manager
• WSO2 Identity Server
• CWE-116

Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

• WSO2 API Manager
• WSO2 Universal Gateway
• Authentication bypass

Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks

• WSO2 Open Banking AM
• WSO2 API Manager
• Open redirect

Stored Cross-Site Scripting in Multiple WSO2 Products

• WSO2 API Manager
• WSO2 Carbon API Manager Publisher REST API
• Cross-site scripting (XSS)

SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

• WSO2 API Manager
• WSO2 Traffic Manager
• SQL injection

Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

• WSO2 API Manager
• WSO2 Traffic Manager
• Information disclosure

Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products

• WSO2 Enterprise Integrator
• WSO2 API Manager
• Cross-site scripting (XSS)

Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks

• WSO2 API Manager
• WSO2 Identity Server
• CWE-799

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• Broken access control

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

• WSO2 API Manager
• WSO2 Traffic Manager
• Authentication bypass

Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products

• WSO2 API Manager
• WSO2 API Control Plane
• Cross-site scripting (XSS)

Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• Server-side request forgery (SSRF)

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

• WSO2 API Manager
• WSO2 Open Banking AM
• CWE-20

Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• CWE-204

Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

• WSO2 API Manager
• Open redirect

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection

• WSO2 Enterprise Integrator
• WSO2 Identity Server
• Cross-site scripting (XSS)

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery

• WSO2 Enterprise Integrator
• WSO2 Identity Server
• Authentication bypass

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

• WSO2 Enterprise Integrator
• WSO2 API Manager
• Code injection

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

• WSO2 API Control Plane
• WSO2 Universal Gateway
• Authentication bypass

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Information disclosure

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

• WSO2 API Manager
• WSO2 Universal Gateway
• Broken access control

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

• WSO2 API Manager
• WSO2 Universal Gateway
• Cross-site scripting (XSS)

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution

• WSO2 Enterprise Integrator
• WSO2 API Manager
• Command injection

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

• WSO2 API Manager
• WSO2 API Control Plane
• Information disclosure

Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

• WSO2 API Control Plane
• WSO2 API Manager
• Cross-site scripting (XSS)

Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft

• WSO2 API Control Plane
• WSO2 API Manager
• CWE-20
• CWE-603

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

• WSO2 Open Banking AM
• WSO2 Open Banking IAM
• Command injection

Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads

• WSO2 API Manager
• WSO2 API Control Plane
• Weak cryptography or TLS

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

• WSO2 API Manager
• WSO2 Traffic Manager
• Unrestricted file upload

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

• WSO2 API Manager
• WSO2 Universal Gateway
• Denial of service

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

• WSO2 API Manager
• WSO2 API Control Plane
• Broken access control

User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

• WSO2 API Manager
• Cross-site scripting (XSS)

Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

• WSO2 Micro Integrator
• WSO2 Enterprise Integrator
• CWE-20

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Weak cryptography or TLS

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

• WSO2 API Manager
• WSO2 API Control Plane
• Privilege escalation

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

• WSO2 Identity Server
• WSO2 API Manager
• CWE-693

Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery

• WSO2 API Manager
• WSO2 API Control Plane
• Other injection
• CWE-20

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site request forgery (CSRF)

Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

• WSO2 Identity Server as Key Manager
• WSO2 Identity Server
• Information disclosure

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

• WSO2 API Control Plane
• WSO2 Traffic Manager
• CWE-20

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

• WSO2 Enterprise Integrator
• WSO2 API Control Plane
• CWE-693

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

• WSO2 API Manager
• WSO2 Traffic Manager
• Authentication bypass

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

• WSO2 API Manager
• WSO2 API Control Plane
• Cross-site scripting (XSS)

Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• CWE-707

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site scripting (XSS)

Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

• WSO2 API Manager
• WSO2 Identity Server
• CWE-298

Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure

• WSO2 Identity Server
• WSO2 API Manager
• Authentication bypass

Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager

• WSO2 API Manager
• Server-side request forgery (SSRF)

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

• WSO2 API Control Plane
• WSO2 Universal Gateway
• CWE-281

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

• WSO2 API Manager
• WSO2 Universal Gateway
• Other injection

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites

• WSO2 API Manager
• WSO2 Identity Server
• Cross-site scripting (XSS)

Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection

• WSO2 API Manager
• Cross-site scripting (XSS)

XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files

• WSO2 API Manager
• XML external entities (XXE)

Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval

• WSO2 API Manager
• Cross-site scripting (XSS)

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service

• WSO2 API Manager
• WSO2 Identity Server
• XML external entities (XXE)

A local user can be impersonated when using federated authentication with Silent JIT Provisioning.

• WSO2 API Manager
• WSO2 Identity Server
• Authentication bypass

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

• WSO2 API Manager
• WSO2 API Control Plane
• Authentication bypass