Advisories · Technology
WSO2 Carbon Identity Application Authentication Framework.
Every CVE that names WSO2 Carbon Identity Application Authentication Framework among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 2.7 Low
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Code injection
- CVSS 5.3 Medium
Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
- WSO2 API Manager
- WSO2 API Control Plane
- Information disclosure
- CVSS 9.4 CriticalCritical · CVSS 9+
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 API Manager
- CWE-693
- CVSS 4.3 Medium
Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure
- WSO2 Identity Server
- WSO2 Carbon Identity Application Authentication Framework
- Information disclosure
- CWE-20