Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen.
Product
WSO2 API Manager ist eine Open-Source-Plattform für das Management von APIs, die deren Erstellung, Veröffentlichung, Steuerung und Analyse ermöglicht.
Vulnerabilities 2
-
Medium 5.8
Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernames during authentication attempts. This oversight allows an attacker to repeatedly query the authentication mechanism w…
-
Medium 5.4
Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used …
Revision history
-
#1
Initiale Fassung
References
-
GitHub Advisory Database vom 2026-10-21
https://github.com/advisories/GHSA-XGHC-F7XH-FW48
-
WSO2 Advisory vom 2026-10-21
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3403/
-
GitHub Advisory Database vom 2026-10-21
https://github.com/advisories/GHSA-5QCP-39QG-FMP5
-
WSO2 Advisory vom 2026-10-21
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3606/