Advisories · Technology
WSO2 Carbon API Management Implementation.
Every CVE that names WSO2 Carbon API Management Implementation among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.7 High
SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption
- WSO2 API Manager
- WSO2 Traffic Manager
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution
- WSO2 API Manager
- WSO2 Traffic Manager
- Unrestricted file upload
- CVSS 8.7 High
XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
- WSO2 API Manager
- WSO2 Universal Gateway
- Denial of service
- CVSS 9.0 CriticalCritical · CVSS 9+
Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
- CVSS 6.3 Medium
Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
- WSO2 API Control Plane
- WSO2 Universal Gateway
- CWE-281
- CVSS 5.3 Medium
HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
- WSO2 API Manager
- WSO2 Universal Gateway
- Other injection