Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um beliebigen Programmcode auszuführen, Informationen auszulesen, Dateien zu manipulieren, oder einen Denial of Service Angriff durchzuführen.
Product
WSO2 API Manager ist eine Open-Source-Plattform für das Management von APIs, die deren Erstellung, Veröffentlichung, Steuerung und Analyse ermöglicht.
Vulnerabilities 2
-
Medium 6.1
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's br…
-
Low 3.1
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately be…
Revision history
-
#1
Initiale Fassung
References
-
WSO2 Security Announcement vom 2026-10-29
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/
-
WSO2 Security Announcement vom 2026-10-29
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4850/