Advisories · Technology
WSO2 Identity Server.
Every CVE that names WSO2 Identity Server among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.4 High
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
- WSO2 API Manager
- WSO2 Open Banking IAM
- Unrestricted file upload
- CVSS 6.7 Medium
Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Unrestricted file upload
- CVSS 4.3 Medium
Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Authentication bypass
- CVSS 5.9 Medium
SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
- CVSS 9.6 CriticalCritical · CVSS 9+
Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
- WSO2 API Manager
- WSO2 API Control Plane
- Broken access control
- CVSS 6.7 Medium
Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Unrestricted file upload
- CVSS 3.3 Low
Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Authentication bypass
- CVSS 6.1 Medium
Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server Account Registration Flow
- WSO2 Identity Server
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login
- WSO2 Open Banking IAM
- WSO2 Identity Server as Key Manager
- Authentication bypass
- CVSS 4.3 Medium
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Broken access control
- CVSS 4.3 Medium
Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup
- WSO2 Open Banking AM
- WSO2 Open Banking KM
- Broken access control
- CVSS 6.1 Medium
Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding
- WSO2 API Manager
- WSO2 Identity Server
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication
- WSO2 Identity Server
- WSO2 Client Attestation Filter
- Authentication bypass
- CVSS 4.6 Medium
Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow
- WSO2 Identity Server
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- WSO2 API Manager
- WSO2 Governance Registry
- Broken access control
- CVSS 6.1 Medium
Cross-site scripting in WSO2 API Manager and others
- WSO2 API Manager
- WSO2 Identity Server
- Cross-site scripting (XSS)