Advisories · Technology
WSO2 Carbon API Manager Rest API Utility.
Every CVE that names WSO2 Carbon API Manager Rest API Utility among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.4 CriticalCritical · CVSS 9+
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
- CVSS 10.0 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV
Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover
- WSO2 Universal Gateway
- WSO2 Traffic Manager
- Weak cryptography or TLS
- CVSS 9.8 CriticalCritical · CVSS 9+
Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover
- WSO2 API Manager
- WSO2 API Control Plane
- Privilege escalation
- CVSS 6.3 Medium
Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations
- WSO2 API Control Plane
- WSO2 Universal Gateway
- CWE-281