Wso2 Carbon Api Management Implementation
Monthly
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Gateway operations, because the 'Internal/Everyone' role that satisfies these checks is granted to every account by default; in WSO2 APIM 3.x the same flaw also exposes Internal Service APIs. Affected deployments span WSO2 API Manager 3.2.0 through 4.5.0 as well as Universal Gateway, Traffic Manager, API Control Plane and the associated Carbon API Management Implementation / REST API Utility components below their fixed patch levels, and exploitation requires only a valid low-privilege account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, assessed impact on confidentiality and integrity only) - no anonymous path exists. No public exploit code has been identified at time of analysis, EPSS is 0.03% (10th percentile), CISA SSVC records Exploitation: none and Automatable: no, so this is best treated as a high-privilege-bypass risk concentrated in internet-facing or self-service-signup API portals rather than an imminent mass-exploitation threat.
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic Manager, API Control Plane, Carbon API Gateway, and Carbon API Management Implementation) lets unauthenticated remote attackers inject or overwrite arbitrary HTTP response headers through the Webhook API invocation path. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - any reachable, pre-fix Webhook endpoint is sufficient, and the confidentiality-neutral but integrity-high rating (C:N/I:H/A:N, base 7.5) reflects that tampered headers can poison browser caches, weaken security headers, or inject cookie values to enable session hijacking. Exploitation is not confirmed to be active and no public exploit code has been identified at time of analysis; EPSS is low at 0.04% (12th percentile), and CISA's SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. Patches are available per the vendor advisory.
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Gateway operations, because the 'Internal/Everyone' role that satisfies these checks is granted to every account by default; in WSO2 APIM 3.x the same flaw also exposes Internal Service APIs. Affected deployments span WSO2 API Manager 3.2.0 through 4.5.0 as well as Universal Gateway, Traffic Manager, API Control Plane and the associated Carbon API Management Implementation / REST API Utility components below their fixed patch levels, and exploitation requires only a valid low-privilege account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, assessed impact on confidentiality and integrity only) - no anonymous path exists. No public exploit code has been identified at time of analysis, EPSS is 0.03% (10th percentile), CISA SSVC records Exploitation: none and Automatable: no, so this is best treated as a high-privilege-bypass risk concentrated in internet-facing or self-service-signup API portals rather than an imminent mass-exploitation threat.
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic Manager, API Control Plane, Carbon API Gateway, and Carbon API Management Implementation) lets unauthenticated remote attackers inject or overwrite arbitrary HTTP response headers through the Webhook API invocation path. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - any reachable, pre-fix Webhook endpoint is sufficient, and the confidentiality-neutral but integrity-high rating (C:N/I:H/A:N, base 7.5) reflects that tampered headers can poison browser caches, weaken security headers, or inject cookie values to enable session hijacking. Exploitation is not confirmed to be active and no public exploit code has been identified at time of analysis; EPSS is low at 0.04% (12th percentile), and CISA's SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. Patches are available per the vendor advisory.