WSO2 Universal Gateway.

Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Broken access control

Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts

• WSO2 API Manager
• WSO2 Universal Gateway
• Authentication bypass

SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inference and Service Disruption

• WSO2 API Manager
• WSO2 Traffic Manager
• SQL injection

Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

• WSO2 API Manager
• WSO2 Traffic Manager
• Information disclosure

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• Broken access control

Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]

• WSO2 API Manager
• WSO2 Traffic Manager
• Authentication bypass

Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination

• WSO2 API Control Plane
• WSO2 Universal Gateway
• Authentication bypass

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Information disclosure

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

• WSO2 API Manager
• WSO2 Universal Gateway
• Broken access control

Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

• WSO2 API Manager
• WSO2 Universal Gateway
• Cross-site scripting (XSS)

Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery

• WSO2 API Manager
• WSO2 API Control Plane
• Information disclosure

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

• WSO2 Open Banking AM
• WSO2 Open Banking IAM
• Command injection

Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution

• WSO2 API Manager
• WSO2 Traffic Manager
• Unrestricted file upload

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

• WSO2 API Manager
• WSO2 Universal Gateway
• Denial of service

Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations

• WSO2 API Manager
• WSO2 API Control Plane
• Broken access control

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Weak cryptography or TLS

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

• WSO2 API Manager
• WSO2 API Control Plane
• Privilege escalation

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

• WSO2 Identity Server
• WSO2 API Manager
• CWE-693

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site request forgery (CSRF)

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

• WSO2 API Control Plane
• WSO2 Traffic Manager
• CWE-20

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

• WSO2 Enterprise Integrator
• WSO2 API Control Plane
• CWE-693

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

• WSO2 API Manager
• WSO2 Traffic Manager
• Authentication bypass

Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• CWE-707

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

• WSO2 Identity Server
• WSO2 API Manager
• Cross-site scripting (XSS)

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

• WSO2 API Control Plane
• WSO2 Universal Gateway
• CWE-281

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

• WSO2 API Manager
• WSO2 Universal Gateway
• Other injection

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

• WSO2 API Manager
• WSO2 API Control Plane
• Authentication bypass

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

• WSO2 Open Banking AM
• WSO2 Open Banking IAM
• Cross-site request forgery (CSRF)

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

• WSO2 Open Banking IAM
• WSO2 API Manager
• Cross-site scripting (XSS)

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)

• WSO2 Micro Integrator
• WSO2 API Manager
• Code injection

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

• WSO2 API Manager
• WSO2 Open Banking IAM
• Unrestricted file upload

Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution

• WSO2 Identity Server
• WSO2 Enterprise Integrator
• Unrestricted file upload

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

• WSO2 Identity Server
• WSO2 Enterprise Integrator
• Authentication bypass

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

• WSO2 Identity Server
• WSO2 Enterprise Integrator
• Cross-site scripting (XSS)
• Server-side request forgery (SSRF)

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

• WSO2 Identity Server as Key Manager
• WSO2 Identity Server
• Broken access control

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

• WSO2 API Manager
• WSO2 API Control Plane
• Broken access control