Wso2
Monthly
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making server-initiated requests to attacker-chosen destinations by injecting crafted WS-Addressing headers into the message flow. Because the API Manager typically sits at the network edge with reachability into internal systems, this allows pivoting to otherwise unreachable internal resources and services. The vendor rates it CVSS 10.0; it is not in CISA KEV and no public exploit identified at time of analysis, with a low EPSS of 0.20% (10th percentile).
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reverse tabnapping in WSO2 API Manager and WSO2 API Control Plane exposes authenticated users to window-context hijacking when the portal opens external links without nullifying the JavaScript `window.opener` reference. An attacker who can surface a malicious external link within the portal - via API documentation fields, link-accepting content areas, or other user-controlled inputs - can redirect the user's original authenticated portal tab to an attacker-controlled phishing page once the external link is clicked. The vendor has published advisory WSO2-2026-5164; no public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared secrets for Webhook HMAC validation, violating the principle that secret generation must use cryptographically secure entropy sources (CWE-330). An unauthenticated remote attacker who can observe sufficient PRNG-derived webhook secrets - for example via API Publisher UI or intercepted webhook registrations - can statistically reconstruct the generator state and predict future secrets. With a predicted secret, the attacker forges event payloads bearing valid HMAC signatures, bypassing the API Gateway's authenticity checks and enabling unauthorized event injection, data manipulation, and potential downstream system compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.
Insufficient refresh token invalidation in WSO2 Identity Server's user impersonation flow allows a privileged attacker who has already obtained an impersonated access token to silently renew that authorization via the OAuth refresh token grant, sustaining unauthorized access well beyond the intended session lifetime. The integrity impact is two-fold: the attacker continues performing actions on behalf of the legitimate user, and audit logs attribute those actions to the victim identity rather than the true actor, corrupting traceability and compliance posture. No public exploit is identified and exploitation is bounded by high privilege prerequisites (PR:H) and adjacent network access (AV:A), placing realistic risk firmly in insider-threat and compromised-administrator scenarios.
Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.
WSO2 Identity Server's implicit-association resolver incorrectly initializes from a secondary user store rather than the primary store when multiple user stores are configured, causing identity confusion during external IDP authentication flows. When the same lookup claim - such as a username or email address - exists in both the primary and a secondary store, an external IDP subject is silently associated with the wrong local account, either denying legitimate users their expected access level or, in adversarially constructed scenarios, potentially hijacking an IDP association intended for a primary-store user. The vulnerability is only triggered when secondary user stores are active, implicit association is enabled, and duplicate claim values exist across stores - deployments not meeting all three conditions are unaffected. No public exploit code has been identified at time of analysis and the issue is not listed in the CISA KEV catalog.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis.
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, API Control Plane, Traffic Manager, Universal Gateway, Open Banking AM/IAM, and Identity Server as Key Manager - allows unauthenticated remote attackers to inject arbitrary script via unsanitized URL parameters. An attacker who tricks an authenticated user into clicking a crafted link can redirect the victim to a malicious site, tamper with rendered page content, or exfiltrate non-session browser data; partial mitigation is provided by httpOnly flags on session cookies, which block direct session token theft. No public exploit identified at time of analysis; WSO2 self-reported the issue and published advisory WSO2-2025-4343.
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-tenant consent leakage in WSO2 Identity Server and WSO2 API Manager multi-tenant deployments lets a SaaS application in one tenant inherit OAuth/OpenID consent that a user granted to a same-named application in a different tenant, breaking tenant isolation of authorization scopes. Because matching is done by application name rather than a tenant-scoped identifier, an application in attacker-controlled tenant B can read and modify a victim's data in tenant A without that user's explicit authorization. No active exploitation is reported (not in CISA KEV, EPSS 0.15%/4th percentile) and no public exploit is identified, but a vendor patch is available.
Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated attackers to crash the authentication service by flooding invalid login requests without rate limiting. The vulnerability affects deployments using the Magic Link authentication flow and has an EPSS score indicating moderate exploitation likelihood. WSO2 has published a security advisory (WSO2-2025-4469) with remediation guidance for affected Identity Server and Carbon MagicLink Authenticator Module installations.
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentication flow execution, allowing privileged users in one organization to trigger authentication logic on other organizations. An attacker with adaptive authentication configuration privileges can exploit this context validation gap to bypass authorization boundaries, escalate privileges, and gain unauthorized access to user accounts and resources across organizational boundaries.
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to invoke Gateway and Internal Service APIs without proper permission enforcement, enabling unauthorized operations on sensitive REST API endpoints. The vulnerability affects multiple WSO2 products including API Control Plane, Universal Gateway, and Traffic Manager. CVSS 6.3 (network-accessible, low complexity, requires valid user credentials) indicates moderate severity with clear lateral privilege escalation potential in multi-tenant environments.
HTTP response header injection in WSO2 Webhook API invocations allows unauthenticated remote attackers to inject or overwrite arbitrary HTTP response headers via unsanitized user-supplied input. Successful exploitation enables cache manipulation, security header alteration, cookie injection, and potential session hijacking. CVSS 5.3 (network-accessible, low complexity, no authentication required); no public exploit code or active exploitation confirmed at time of analysis.
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Module allows accounts that have been administratively or automatically locked to still authenticate through the Magic Link and Passkey (FIDO2) flows, because those paths do not validate account state. An attacker in possession of a valid magic link or passkey for a locked account can reach the application and its sensitive data despite the lock, and the lockout control intended to stop further login attempts is rendered ineffective. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not in CISA KEV.
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers to inject arbitrary JavaScript into victims' browsers by luring them to click a crafted URL. Versions 7.1.0 prior to 7.1.0.28 are confirmed affected; a vendor patch is available. While the attack can enable browser redirection, UI manipulation, and theft of browser-accessible data, the explicit use of the httpOnly flag on session cookies prevents session hijacking, partially constraining real-world impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.03%.
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are not revoked, allowing locked users to continue accessing protected resources until the tokens naturally expire. Affected versions prior to 5.2.0.35 are vulnerable. A vendor patch is available, but no active exploitation or public exploits are known at this time.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthenticated attackers to inject arbitrary web scripts. Affected versions include API Manager 3.1.0 to 4.1.0 and Identity Server 5.10.0 to 5.11.0. While exploitation requires user interaction, successful attacks can result in information disclosure or UI manipulation; EPSS indicates very low exploitation likelihood, and no active exploitation or public exploit is currently identified.
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The component accepts XML input through the publisher without disabling external entity resolution. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users. [CVSS 7.7 HIGH]
Authenticated remote code execution affects multiple WSO2 products (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0-4.6.0, Universal Gateway 4.5.0, and Traffic Manager 4.5.0-4.6.0) through an unrestricted file upload exposed via a system REST API. An administrator-level attacker can place an arbitrary file at a user-controlled path and trigger code execution on the host. No public exploit identified at time of analysis, EPSS is low at 0.28%, and a vendor patch is available per WSO2 advisory WSO2-2025-4849.
Server-side template injection via Apache Velocity in WSO2 Identity Server 5.11.0 enables an authenticated administrator to execute arbitrary code on the underlying server. The vulnerability stems from insufficient sandboxing of user-controlled input passed to the Velocity rendering engine in admin-accessible surfaces, allowing template directives to invoke JVM reflection and reach OS-level execution. No public exploit code has been identified at time of analysis; EPSS of 0.44% at the 63rd percentile indicates moderate relative interest but low absolute near-term exploitation probability.
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.
A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.
A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users. While this issue enables persistent client-side script execution, session-related cookies remain protected with the httpOnly flag, preventing session hijacking.
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 25.2% and no vendor patch available.
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. Rated medium severity (CVSS 4.2), this vulnerability is no authentication required. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper input validation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability was found in WSO2 carbon-registry up to 4.8.11. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected XSS issue exists in the Management Console of several WSO2 products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffic Manager, and WSO2 API Control Plane - allows an unauthenticated remote attacker to send malicious JSON payloads to the throttling event handling mechanism, crashing or corrupting API Gateway state so that legitimate API traffic can no longer be processed. Because the outage is persistent and requires manual intervention to restore service, and the CVSS scope is changed (S:C), a single request can take down the entire API Gateway tier. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making server-initiated requests to attacker-chosen destinations by injecting crafted WS-Addressing headers into the message flow. Because the API Manager typically sits at the network edge with reachability into internal systems, this allows pivoting to otherwise unreachable internal resources and services. The vendor rates it CVSS 10.0; it is not in CISA KEV and no public exploit identified at time of analysis, with a low EPSS of 0.20% (10th percentile).
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reverse tabnapping in WSO2 API Manager and WSO2 API Control Plane exposes authenticated users to window-context hijacking when the portal opens external links without nullifying the JavaScript `window.opener` reference. An attacker who can surface a malicious external link within the portal - via API documentation fields, link-accepting content areas, or other user-controlled inputs - can redirect the user's original authenticated portal tab to an attacker-controlled phishing page once the external link is clicked. The vendor has published advisory WSO2-2026-5164; no public exploit code and no CISA KEV listing have been identified at time of analysis.
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administrator with adjacent network access to execute arbitrary operating system commands, leading to complete compromise of the affected system. The vulnerability spans at least eight WSO2 middleware products - including API Manager, Identity Server, Open Banking components, Traffic Manager, Universal Gateway, and API Control Plane - all of which share the Carbon Console administrative layer. The CVSS scope-change flag (S:C) indicates that successful exploitation extends impact beyond the WSO2 application boundary to the underlying host and potentially adjacent systems.
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared secrets for Webhook HMAC validation, violating the principle that secret generation must use cryptographically secure entropy sources (CWE-330). An unauthenticated remote attacker who can observe sufficient PRNG-derived webhook secrets - for example via API Publisher UI or intercepted webhook registrations - can statistically reconstruct the generator state and predict future secrets. With a predicted secret, the attacker forges event payloads bearing valid HMAC signatures, bypassing the API Gateway's authenticity checks and enabling unauthorized event injection, data manipulation, and potential downstream system compromise. No public exploit or CISA KEV listing has been identified at time of analysis.
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM, Traffic Manager, Universal Gateway, API Control Plane, Identity Server as Key Manager) lets an attacker skip intermediate multi-factor challenges when the Conditional (Adaptive) Authentication script is configured with a particular multi-step callback/re-execution pattern, resulting in unauthorized takeover of a targeted user account. The flaw stems from the adaptive script failing to enforce completion of all required steps, and carries a high CVSS of 9.4 (C:H/I:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the affected components underpin enterprise SSO/MFA and open-banking IAM, making impact severe where the vulnerable flow exists.
Sensitive information disclosure in WSO2's Carbon Event Publisher Core affects nine WSO2 platform products, including API Manager, Identity Server, and Open Banking components. When an Event Publisher output adapter is misconfigured with extraneous or irrelevant properties, those property values - which may include user credentials or confidential data - are written to the wso2carbon log files without sanitization or masking (CWE-532). A local, high-privileged actor with read access to those log files can extract the inadvertently logged secrets and leverage them for unauthorized access. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
CSRF in the WSO2 Carbon console Ajax processor enables an attacker to silently execute unauthorized state-changing operations on behalf of authenticated administrators across more than ten WSO2 products including Identity Server, API Manager, and Enterprise Integrator. The vulnerability combines two compounding weaknesses: state-altering operations are routed over HTTP GET, and the sole CSRF mitigation - SameSite=Lax - is defeated because browsers permit session cookies to accompany cross-origin top-level GET navigations. No public exploit code has been reported and this CVE does not appear in CISA KEV at time of analysis; however, the breadth of affected WSO2 products and the IAM/API management context make misconfigured internet-exposed deployments a meaningful target for targeted social engineering.
Tenant isolation failure in WSO2 Identity Server allows authenticated low-privilege users to disclose personally identifiable information belonging to users in separate tenants. The vulnerability exists specifically when Email OTP, SMS OTP, or Magic Link are configured as first-factor authenticators - authentication requests processed through these flows lack sufficient validation to enforce organizational tenant boundaries, exposing data such as mobile numbers. No public exploit code or CISA KEV listing exists at time of analysis, but the low-complexity, network-accessible attack vector (CVSS PR:L/AV:N/AC:L) makes this a credible insider threat and compromised-account scenario for multi-tenant deployments.
Insufficient refresh token invalidation in WSO2 Identity Server's user impersonation flow allows a privileged attacker who has already obtained an impersonated access token to silently renew that authorization via the OAuth refresh token grant, sustaining unauthorized access well beyond the intended session lifetime. The integrity impact is two-fold: the attacker continues performing actions on behalf of the legitimate user, and audit logs attribute those actions to the victim identity rather than the true actor, corrupting traceability and compliance posture. No public exploit is identified and exploitation is bounded by high privilege prerequisites (PR:H) and adjacent network access (AV:A), placing realistic risk firmly in insider-threat and compromised-administrator scenarios.
Cross-organizational secret deletion in WSO2 Identity Server's Secret Type Management REST API allows an administrator with delete permissions to inadvertently remove secrets across all organizations in a multi-tenant deployment. The on-delete cascade logic, triggered when a secret type is deleted, fails to enforce organizational boundaries - a multi-tenancy isolation failure classified as CWE-281 (Improper Preservation of Permissions). Exploitation yields availability and integrity impact across the entire deployment, though it is constrained to high-privilege administrator accounts. No public exploit is identified and this vulnerability is not listed in the CISA KEV catalog.
WSO2 Identity Server's implicit-association resolver incorrectly initializes from a secondary user store rather than the primary store when multiple user stores are configured, causing identity confusion during external IDP authentication flows. When the same lookup claim - such as a username or email address - exists in both the primary and a secondary store, an external IDP subject is silently associated with the wrong local account, either denying legitimate users their expected access level or, in adversarially constructed scenarios, potentially hijacking an IDP association intended for a primary-store user. The vulnerability is only triggered when secondary user stores are active, implicit association is enabled, and duplicate claim values exist across stores - deployments not meeting all three conditions are unaffected. No public exploit code has been identified at time of analysis and the issue is not listed in the CISA KEV catalog.
Username enumeration via observable login response discrepancy affects WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 API Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM when the Multi-Attribute Login feature is enabled. When a valid username is submitted, the server resolves and returns the canonical form of that username; when an invalid username is submitted, the server echoes the raw input unchanged - creating a deterministic, scriptable oracle for account existence. This disclosure path persists regardless of the validate_username configuration setting, meaning a common hardening measure provides no defense. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis.
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, API Control Plane, Traffic Manager, Universal Gateway, Open Banking AM/IAM, and Identity Server as Key Manager - allows unauthenticated remote attackers to inject arbitrary script via unsanitized URL parameters. An attacker who tricks an authenticated user into clicking a crafted link can redirect the victim to a malicious site, tamper with rendered page content, or exfiltrate non-session browser data; partial mitigation is provided by httpOnly flags on session cookies, which block direct session token theft. No public exploit identified at time of analysis; WSO2 self-reported the issue and published advisory WSO2-2025-4343.
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-tenant consent leakage in WSO2 Identity Server and WSO2 API Manager multi-tenant deployments lets a SaaS application in one tenant inherit OAuth/OpenID consent that a user granted to a same-named application in a different tenant, breaking tenant isolation of authorization scopes. Because matching is done by application name rather than a tenant-scoped identifier, an application in attacker-controlled tenant B can read and modify a victim's data in tenant A without that user's explicit authorization. No active exploitation is reported (not in CISA KEV, EPSS 0.15%/4th percentile) and no public exploit is identified, but a vendor patch is available.
Memory exhaustion denial-of-service in WSO2 Identity Server's Magic Link authenticator allows remote unauthenticated attackers to crash the authentication service by flooding invalid login requests without rate limiting. The vulnerability affects deployments using the Magic Link authentication flow and has an EPSS score indicating moderate exploitation likelihood. WSO2 has published a security advisory (WSO2-2025-4469) with remediation guidance for affected Identity Server and Carbon MagicLink Authenticator Module installations.
WSO2 Identity Server in multi-organization deployments fails to validate organization context during adaptive authentication flow execution, allowing privileged users in one organization to trigger authentication logic on other organizations. An attacker with adaptive authentication configuration privileges can exploit this context validation gap to bypass authorization boundaries, escalate privileges, and gain unauthorized access to user accounts and resources across organizational boundaries.
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to invoke Gateway and Internal Service APIs without proper permission enforcement, enabling unauthorized operations on sensitive REST API endpoints. The vulnerability affects multiple WSO2 products including API Control Plane, Universal Gateway, and Traffic Manager. CVSS 6.3 (network-accessible, low complexity, requires valid user credentials) indicates moderate severity with clear lateral privilege escalation potential in multi-tenant environments.
HTTP response header injection in WSO2 Webhook API invocations allows unauthenticated remote attackers to inject or overwrite arbitrary HTTP response headers via unsanitized user-supplied input. Successful exploitation enables cache manipulation, security header alteration, cookie injection, and potential session hijacking. CVSS 5.3 (network-accessible, low complexity, no authentication required); no public exploit code or active exploitation confirmed at time of analysis.
Account-lockout bypass in WSO2 Identity Server (6.0.0, 6.1.0, 7.0.0, 7.1.0) and the Carbon MagicLink Authenticator Module allows accounts that have been administratively or automatically locked to still authenticate through the Magic Link and Passkey (FIDO2) flows, because those paths do not validate account state. An attacker in possession of a valid magic link or passkey for a locked account can reach the application and its sensitive data despite the lock, and the lockout control intended to stop further login attempts is rendered ineffective. There is no public exploit identified at time of analysis, EPSS is negligible (0.03%), and the flaw is not in CISA KEV.
The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the existence of registered user accounts. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Reflected cross-site scripting in WSO2 Identity Server's authentication endpoint allows remote unauthenticated attackers to inject arbitrary JavaScript into victims' browsers by luring them to click a crafted URL. Versions 7.1.0 prior to 7.1.0.28 are confirmed affected; a vendor patch is available. While the attack can enable browser redirection, UI manipulation, and theft of browser-accessible data, the explicit use of the httpOnly flag on session cookies prevents session hijacking, partially constraining real-world impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.03%.
Unauthorized access persists in WSO2 Identity Server after user accounts are locked because existing access tokens are not revoked, allowing locked users to continue accessing protected resources until the tokens naturally expire. Affected versions prior to 5.2.0.35 are vulnerable. A vendor patch is available, but no active exploitation or public exploits are known at this time.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthenticated attackers to inject arbitrary web scripts. Affected versions include API Manager 3.1.0 to 4.1.0 and Identity Server 5.10.0 to 5.11.0. While exploitation requires user interaction, successful attacks can result in information disclosure or UI manipulation; EPSS indicates very low exploitation likelihood, and no active exploitation or public exploit is currently identified.
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The component accepts XML input through the publisher without disabling external entity resolution. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user's information may be replaced during the account provisioning process in cases where federated users share the same username as local users. [CVSS 7.7 HIGH]
Authenticated remote code execution affects multiple WSO2 products (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0-4.6.0, Universal Gateway 4.5.0, and Traffic Manager 4.5.0-4.6.0) through an unrestricted file upload exposed via a system REST API. An administrator-level attacker can place an arbitrary file at a user-controlled path and trigger code execution on the host. No public exploit identified at time of analysis, EPSS is low at 0.28%, and a vendor patch is available per WSO2 advisory WSO2-2025-4849.
Server-side template injection via Apache Velocity in WSO2 Identity Server 5.11.0 enables an authenticated administrator to execute arbitrary code on the underlying server. The vulnerability stems from insufficient sandboxing of user-controlled input passed to the Velocity rendering engine in admin-accessible surfaces, allowing template directives to invoke JVM reflection and reach OS-level execution. No public exploit code has been identified at time of analysis; EPSS of 0.44% at the 63rd percentile indicates moderate relative interest but low absolute near-term exploitation probability.
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Authentication. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.
A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin services. This flaw allows unauthenticated attackers to manipulate server-side requests, enabling access to internal and external resources available through the network or filesystem. Exploitation of this vulnerability could lead to unauthorized access to sensitive data and systems, including resources within private networks, as long as they are reachable by the affected product.
A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users. While this issue enables persistent client-side script execution, session-related cookies remain protected with the httpOnly flag, preventing session hijacking.
An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users into visiting a malicious page, enabling phishing attacks to harvest sensitive information or perform other harmful actions.
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registration configuration. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. Epss exploitation probability 25.2% and no vendor patch available.
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. Rated medium severity (CVSS 4.2), this vulnerability is no authentication required. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native authentication to be bypassed when an invalid object is passed. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper input validation. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in the HTTP response. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability was found in WSO2 carbon-registry up to 4.8.11. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in WSO2 Enterprise Integrator 6.4.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected XSS issue exists in the Management Console of several WSO2 products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in certain WSO2 products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.