Wso2 Carbon Api Manager Rest Api Utility
Monthly
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Gateway operations, because the 'Internal/Everyone' role that satisfies these checks is granted to every account by default; in WSO2 APIM 3.x the same flaw also exposes Internal Service APIs. Affected deployments span WSO2 API Manager 3.2.0 through 4.5.0 as well as Universal Gateway, Traffic Manager, API Control Plane and the associated Carbon API Management Implementation / REST API Utility components below their fixed patch levels, and exploitation requires only a valid low-privilege account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, assessed impact on confidentiality and integrity only) - no anonymous path exists. No public exploit code has been identified at time of analysis, EPSS is 0.03% (10th percentile), CISA SSVC records Exploitation: none and Automatable: no, so this is best treated as a high-privilege-bypass risk concentrated in internet-facing or self-service-signup API portals rather than an imminent mass-exploitation threat.
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane, and the Carbon API Manager REST API Utility) allows remote unauthenticated attackers to forge JWT tokens because the authentication layer accepts tokens signed with algorithms outside the explicitly configured/supported set. By crafting a JWT with an unsupported or attacker-chosen algorithm that is then incorrectly validated, an attacker can gain unauthorized access up to full administrative account takeover. Rated CVSS 10.0 (scope-changed) by WSO2, with the description noting a contained 9.8 score for single-tenant deployments; no public exploit identified at time of analysis.
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly issued token, to invoke product-level Admin REST APIs that should be restricted, potentially resulting in full administrative account takeover. The flaw stems from insufficient scope/privilege restriction on issued tokens (CWE-269) and affects API Manager, API Control Plane, Universal Gateway, Traffic Manager, and the Carbon REST API common/utility components. No public exploit identified at time of analysis; exploitation requires the attacker to already hold a low-privileged account and obtain a token for it.
Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Gateway operations, because the 'Internal/Everyone' role that satisfies these checks is granted to every account by default; in WSO2 APIM 3.x the same flaw also exposes Internal Service APIs. Affected deployments span WSO2 API Manager 3.2.0 through 4.5.0 as well as Universal Gateway, Traffic Manager, API Control Plane and the associated Carbon API Management Implementation / REST API Utility components below their fixed patch levels, and exploitation requires only a valid low-privilege account (CVSS 3.1 AV:N/AC:L/PR:L/UI:N, assessed impact on confidentiality and integrity only) - no anonymous path exists. No public exploit code has been identified at time of analysis, EPSS is 0.03% (10th percentile), CISA SSVC records Exploitation: none and Automatable: no, so this is best treated as a high-privilege-bypass risk concentrated in internet-facing or self-service-signup API portals rather than an imminent mass-exploitation threat.