Wso2 Api Manager vulnerabilities

CVE-2024-4598 [MEDIUM] CWE-1259 CVE-2024-4598: An information disclosure vulnerability exists in multiple WSO2 products due to improper implementat An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions. This vulnerability does not impact user crede

CVE-2024-10302 [MEDIUM] CWE-20 CVE-2024-10302: The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected duri

CVE-2024-2321 [MEDIUM] CWE-863 CVE-2024-2321: An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs t An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are not required for API access, potentially enabling unauthorized operations. Exploitation requi

CVE-2025-7043 [MEDIUM] CWE-862 CVE-2025-7043: The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be t The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token. An attacker who obtains

CVE-2025-6024 [MEDIUM] CWE-79 CVE-2025-6024: The authentication endpoint fails to encode user-supplied input before rendering it in the web page, The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, o

CVE-2024-7478 [MEDIUM] CWE-204 CVE-2024-7478: When a WSO2 product is configured to use an external user store, the system fails to adequately obsc When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism with different username guesses, enabling the enumeration of valid usernames present in the ext

CVE-2024-1248 [MEDIUM] CWE-298 CVE-2024-1248: The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation

CVE-2025-7203 [MEDIUM] CWE-312 CVE-2025-7203: The Management Console and product files expose sensitive data, including remote log server credenti The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled. An attacker with administrative access to the Manage

CVE-2026-2445 [MEDIUM] CWE-79 CVE-2026-2445: The affected product accepts user-supplied input within a URL parameter without enforcing expected s The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify

CVE-2024-10242 [MEDIUM] CWE-79 CVE-2024-10242: The authentication endpoint fails to adequately validate user-supplied input before reflecting it ba The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an attacker to redirect the user's browser to a malicious we

CVE-2024-1440 [MEDIUM] CWE-601 CVE-2024-1440: An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi-option authentication is enabled. A malicious actor can craft a valid link that redirects users to an attacker-controlled site. By exploiting this vulnerability, an attacker may trick users in

CVE-2024-8995 [MEDIUM] CWE-613 CVE-2024-8995: Unused authorization codes issued to deleted users are not being properly invalidated or removed fro Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unus

CVE-2025-8591 [MEDIUM] CWE-79 CVE-2025-8591: The software accepts user-supplied input via a URL parameter without adequate output encoding before The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious websit

CVE-2024-7096 [MEDIUM] CWE-863 CVE-2024-7096: A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw i A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met: * SOAP admin services are accessible to the attacker. * The deployment includes an internally used attribute that

CVE-2024-2323 [MEDIUM] CWE-307 CVE-2024-2323: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the p The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this vulnerability enables an attacker to discover a user's passw

CVE-2024-5962 [MEDIUM] CWE-79 CVE-2024-5962: A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multip A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missing output encoding of user-supplied input. A malicious actor can exploit this vulnerability to inject arbitrary JavaScript into the authentication flow, potentially leading to UI modifications, redirections to malicious websi

CVE-2023-6835 [MEDIUM] CWE-20 CVE-2023-6835: Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validatio Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

CVE-2025-13394 [MEDIUM] CWE-352 CVE-2025-13394: The Ajax processor within the Carbon console fails to adequately protect state-changing operations f The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with

CVE-2025-5802 [MEDIUM] CWE-203 CVE-2025-5802: The self-registration flow accepts user-supplied input for usernames without adequately preventing t The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error message that explicitly indicates the username is already in use. This behavior allows an attacker to discover valid user

CVE-2023-6838 [MEDIUM] CWE-79 CVE-2023-6838: Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endp Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.