Advisories · Technology
WSO2 Identity Server as Key Manager.
Every CVE that names WSO2 Identity Server as Key Manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.8 Medium
Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
- WSO2 Universal Gateway
- WSO2 Traffic Manager
- Broken access control
- CVSS 4.3 Medium
Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
- WSO2 API Manager
- WSO2 Identity Server
- CWE-116
- CVSS 4.9 Medium
Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
- WSO2 API Manager
- WSO2 Universal Gateway
- Authentication bypass
- CVSS 5.4 Medium
Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
- WSO2 Open Banking AM
- WSO2 API Manager
- Open redirect
- CVSS 4.4 Medium
Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
- WSO2 API Manager
- WSO2 Traffic Manager
- Information disclosure
- CVSS 5.8 Medium
Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
- WSO2 Identity Server
- WSO2 Open Banking IAM
- Information disclosure
- CVSS 9.4 CriticalCritical · CVSS 9+
Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- Broken access control
- CVSS 3.1 Low
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
- WSO2 API Manager
- WSO2 Traffic Manager
- Authentication bypass
- CVSS 8.3 High
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- Server-side request forgery (SSRF)
- CVSS 4.0 Medium
Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
- WSO2 API Manager
- WSO2 Open Banking AM
- CWE-20
- CVSS 5.8 Medium
Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
- WSO2 API Manager
- WSO2 Identity Server as Key Manager
- CWE-204
- CVSS 6.1 Medium
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Authentication bypass
- CVSS 2.7 Low
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Code injection
- CVSS 6.5 Medium
Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination
- WSO2 API Control Plane
- WSO2 Universal Gateway
- Authentication bypass
- CVSS 8.2 High
Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
- WSO2 Identity Server as Key Manager
- WSO2 Open Banking IAM
- Information disclosure
- CWE-281
- CVSS 9.1 CriticalCritical · CVSS 9+
Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Command injection
- CVSS 5.3 Medium
Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery
- WSO2 API Manager
- WSO2 API Control Plane
- Information disclosure
- CVSS 8.4 High
Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
- WSO2 Open Banking AM
- WSO2 Open Banking IAM
- Command injection
- CVSS 9.4 CriticalCritical · CVSS 9+
Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 API Manager
- CWE-693
- CVSS 5.4 Medium
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
- WSO2 Identity Server
- WSO2 API Manager
- Cross-site request forgery (CSRF)
- CVSS 3.7 Low
Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Information disclosure
- CVSS 4.0 Medium
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
- WSO2 API Control Plane
- WSO2 Traffic Manager
- CWE-20
- CVSS 5.9 Medium
Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
- WSO2 Enterprise Integrator
- WSO2 API Control Plane
- CWE-693
- CVSS 4.9 Medium
Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access
- WSO2 API Manager
- WSO2 Traffic Manager
- Authentication bypass
- CVSS 6.1 Medium
Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
- WSO2 Identity Server
- WSO2 API Manager
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
- WSO2 API Manager
- WSO2 Identity Server
- CWE-298
- CVSS 5.3 Medium
Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Identity Server
- WSO2 Open Banking IAM
- CWE-204
- CVSS 7.5 High
XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service
- WSO2 API Manager
- WSO2 Identity Server
- XML external entities (XXE)
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products
- WSO2 API Manager
- WSO2 API Control Plane
- Authentication bypass
- CVSS 8.8 High
Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
- WSO2 Open Banking AM
- WSO2 Open Banking IAM
- Cross-site request forgery (CSRF)
- CVSS 5.2 Medium
Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
- WSO2 Open Banking IAM
- WSO2 API Manager
- Cross-site scripting (XSS)
- CVSS 8.4 High
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
- WSO2 Micro Integrator
- WSO2 API Manager
- Code injection
- CVSS 8.4 High
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
- WSO2 API Manager
- WSO2 Open Banking IAM
- Unrestricted file upload
- CVSS 6.7 Medium
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Unrestricted file upload
- CVSS 4.3 Medium
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Authentication bypass
- CVSS 5.9 Medium
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
- CVSS 6.7 Medium
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Unrestricted file upload
- CVSS 3.3 Low
Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Authentication bypass
- CVSS 6.8 Medium
Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login
- WSO2 Open Banking IAM
- WSO2 Identity Server as Key Manager
- Authentication bypass
- CVSS 4.3 Medium
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Broken access control
- CVSS 4.3 Medium
Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- WSO2 Open Banking AM
- WSO2 Open Banking KM
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- WSO2 API Manager
- WSO2 Governance Registry
- Broken access control