Wso2 Carbon Scim Common Component
Monthly
The SCIM provisioning endpoints in WSO2 Identity Server, Identity Server as Key Manager, and Open Banking IAM fail to disambiguate between a local user and a federated user that share the same username, so a federated identity can be acted upon as if it were the colliding local account. An attacker who can authenticate as a federated user - and who either already holds a federated identity matching a target's username or can self-register one where self-registration is enabled - can reach the SCIM 2.0 or SCIM 1.1 user endpoints and perform arbitrary operations against the local user store, up to and including account takeover; deployments without self-registration are rated medium severity by the vendor because the collision must be pre-arranged. Exploitation requires authentication as a federated user and a reachable SCIM endpoint, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor's own CVSS of 8.2 uses a PR:N vector while our assessment treats the federated-user requirement as PR:L, giving 8.1-equivalent integrity impact with limited confidentiality exposure.
The SCIM provisioning endpoints in WSO2 Identity Server, Identity Server as Key Manager, and Open Banking IAM fail to disambiguate between a local user and a federated user that share the same username, so a federated identity can be acted upon as if it were the colliding local account. An attacker who can authenticate as a federated user - and who either already holds a federated identity matching a target's username or can self-register one where self-registration is enabled - can reach the SCIM 2.0 or SCIM 1.1 user endpoints and perform arbitrary operations against the local user store, up to and including account takeover; deployments without self-registration are rated medium severity by the vendor because the collision must be pre-arranged. Exploitation requires authentication as a federated user and a reachable SCIM endpoint, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor's own CVSS of 8.2 uses a PR:N vector while our assessment treats the federated-user requirement as PR:L, giving 8.1-equivalent integrity impact with limited confidentiality exposure.