CVE-2024-8995: Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these…

PriorityP429medium4.9CVSS 3.1

AVNACHPRLUINSCCLILAN

EPSS

0.19%

7.8th percentile

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code.

Affected

57 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	api_control_plane	>= 4.5.0 < 4.5.0.56	4.5.0.56
wso2	api_control_plane	>= 4.6.0 < 4.6.0.20	4.6.0.20
wso2	api_manager	>= 3.1.0 < 3.1.0.320	3.1.0.320
wso2	api_manager	>= 3.2.0 < 3.2.0.413	3.2.0.413
wso2	api_manager	>= 3.2.1 < 3.2.1.90	3.2.1.90
wso2	api_manager	>= 4.0.0 < 4.0.0.334	4.0.0.334
wso2	api_manager	>= 4.1.0 < 4.1.0.255	4.1.0.255
wso2	api_manager	>= 4.2.0 < 4.2.0.195	4.2.0.195
wso2	api_manager	>= 4.3.0 < 4.3.0.106	4.3.0.106
wso2	api_manager	>= 4.4.0 < 4.4.0.70	4.4.0.70
wso2	api_manager	>= 4.5.0 < 4.5.0.55	4.5.0.55
wso2	api_manager	>= 4.6.0 < 4.6.0.19	4.6.0.19
wso2	identity_server	>= 5.10.0 < 5.10.0.338	5.10.0.338
wso2	identity_server	>= 5.11.0 < 5.11.0.395	5.11.0.395
wso2	identity_server	>= 6.0.0 < 6.0.0.229	6.0.0.229
wso2	identity_server	>= 6.1.0 < 6.1.0.208	6.1.0.208
wso2	identity_server_as_key_manager	>= 5.10.0 < 5.10.0.338	5.10.0.338
wso2	open_banking_am	>= 2.0.0 < 2.0.0.369	2.0.0.369
wso2	open_banking_iam	>= 2.0.0 < 2.0.0.389	2.0.0.389
wso2	traffic_manager	>= 4.5.0 < 4.5.0.54	4.5.0.54
wso2	traffic_manager	>= 4.6.0 < 4.6.0.19	4.6.0.19
wso2	universal_gateway	>= 4.5.0 < 4.5.0.55	4.5.0.55
wso2	universal_gateway	>= 4.6.0 < 4.6.0.19	4.6.0.19
wso2	wso2_api_control_plane	>= 4.5.0 < 4.5.0.56	4.5.0.56
wso2	wso2_api_control_plane	>= 4.6.0 < 4.6.0.20	4.6.0.20

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.