IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al

wso2 api control plane güvenlik açıkları (CVE)

wso2 api control plane için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

31 sonuç
8.4Yüksek
CVE-2025-12737

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

WSO2 WSO2 Open Banking AM; WSO2 WSO2 Open Banking IAM; WSO2 WSO2 Traffic Manager; WSO2 WSO2 Universal Gateway

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation ena…

10.0Kritik
CVE-2026-5430 KEV

Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

WSO2 WSO2 Universal Gateway; WSO2 WSO2 Traffic Manager; WSO2 WSO2 API Control Plane; WSO2 WSO2 API Manager

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acce…

22%EPSS
9.8Kritik
CVE-2026-1728

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

WSO2 WSO2 API Manager; WSO2 WSO2 API Control Plane; WSO2 WSO2 Universal Gateway; WSO2 WSO2 Traffic Manager

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentia…

5.4Orta
CVE-2025-13394

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

WSO2 WSO2 Identity Server; WSO2 WSO2 API Manager; WSO2 WSO2 Open Banking IAM; WSO2 WSO2 Open Banking AM

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute …

4.0Orta
CVE-2024-10302

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

WSO2 WSO2 API Control Plane; WSO2 WSO2 Traffic Manager; WSO2 WSO2 Universal Gateway; WSO2 WSO2 API Manager

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input i…

5.9Orta
CVE-2024-6832

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

WSO2 WSO2 Enterprise Integrator; WSO2 WSO2 API Control Plane; WSO2 WSO2 Traffic Manager; WSO2 WSO2 Universal Gateway

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authent…

4.9Orta
CVE-2024-8995

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

WSO2 WSO2 API Manager; WSO2 WSO2 Traffic Manager; WSO2 WSO2 API Control Plane; WSO2 WSO2 Universal Gateway

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and…

8.6Yüksek
CVE-2026-4249

Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

WSO2 WSO2 Universal Gateway; WSO2 WSO2 Traffic Manager; WSO2 WSO2 API Control Plane; WSO2 WSO2 API Manager

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a…

6.3Orta
CVE-2025-8325

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

WSO2 WSO2 API Control Plane; WSO2 WSO2 Universal Gateway; WSO2 WSO2 Traffic Manager; WSO2 WSO2 API Manager

The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, pote…

5.3Orta
CVE-2025-8154

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

WSO2 WSO2 API Manager; WSO2 WSO2 Universal Gateway; WSO2 WSO2 Traffic Manager; WSO2 WSO2 API Control Plane

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can i…

9.8Kritik
CVE-2025-9312

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

WSO2 WSO2 API Manager; WSO2 WSO2 API Control Plane; WSO2 WSO2 Traffic Manager; WSO2 WSO2 Universal Gateway

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default co…

8.8Yüksek
CVE-2025-6670

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

WSO2 WSO2 Open Banking AM; WSO2 WSO2 Open Banking IAM; WSO2 WSO2 Traffic Manager; WSO2 WSO2 Universal Gateway

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax …

5.2Orta
CVE-2025-10853

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

WSO2 WSO2 Open Banking IAM; WSO2 WSO2 API Manager; WSO2 WSO2 Identity Server; WSO2 WSO2 Open Banking AM

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leadin…

8.4Yüksek
CVE-2025-11093

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)

WSO2 WSO2 Micro Integrator; WSO2 WSO2 API Manager; WSO2 WSO2 Enterprise Integrator; WSO2 WSO2 Universal Gateway

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration ru…

8.4Yüksek
CVE-2025-10907

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

WSO2 WSO2 API Manager; WSO2 WSO2 Open Banking IAM; WSO2 WSO2 Open Banking AM; WSO2 WSO2 API Control Plane

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-c…

6.5Orta
CVE-2025-10713

XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

WSO2 WSO2 Enterprise Integrator; WSO2 WSO2 API Control Plane; WSO2 WSO2 Universal Gateway; WSO2 WSO2 Traffic Manager

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A succes…

6.7Orta
CVE-2025-3125

Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution

WSO2 WSO2 Identity Server; WSO2 WSO2 Enterprise Integrator; WSO2 WSO2 Open Banking IAM; WSO2 WSO2 Identity Server as Key Manager

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload a malicious file to a user-controlled lo…

4.3Orta
CVE-2025-5605

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

WSO2 WSO2 Identity Server; WSO2 WSO2 Enterprise Integrator; WSO2 WSO2 Universal Gateway; WSO2 WSO2 Traffic Manager

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in parti…