Skip to content
OpenAdvisories

Vendor

WSO2

131 known vulnerabilities.

Products

WSO2 API Manager 95 WSO2 Identity Server 88 WSO2 Identity Server as Key Manager 54 WSO2 API Control Plane 51 WSO2 Open Banking IAM 51 WSO2 Open Banking AM 45 WSO2 Universal Gateway 40 WSO2 Traffic Manager 40 WSO2 Enterprise Integrator 29 WSO2 Carbon OAuth 8 WSO2 Open Banking KM 8 WSO2 Micro Integrator 7 WSO2 Carbon API Management Implementation 6 WSO2 Carbon User Manager Kernel 5 WSO2 Carbon API Manager Rest API Utility 5 WSO2 Carbon Identity Application Authentication Framework 5 WSO2 Enterprise Mobility Manager 4 WSO2 Carbon Identity User Store Configuration UI 3 org.wso2.carbon:org.wso2.carbon.ui 3 WSO2 Enterprise Service Bus 3 org.wso2.carbon:org.wso2.carbon.base 3 WSO2 Carbon MagicLink Authenticator Module 3 WSO2 IS as Key Manager 3 Email OTP Authenticator 3 WSO2 Carbon Registry Resources UI 2 WSO2 Carbon Identity Management 2 WSO2 Carbon API Management API 2 WSO2 Carbon API Gateway 2 WSO2 Carbon API Manager Rest API Common Functions 2 WSO2 Carbon User Management UI 2 org.wso2.carbon:org.wso2.carbon.server.admin 2 WSO2 Carbon Identity Recovery Management 2 WSO2 API Manager Analytics 2 carbon-registry 2 WSO2 API Microgateway 2 WSO2 Identity Server Analytics 2 WSO2 Data Analytics Server 2 WSO2 Carbon Abstract OTP Authenticator 2 WSO2 Identity Server Keystore Rest API Commons 1 WSO2 Identity Server Keystore Rest API V1 1
All Critical High Medium Low Exploited only Public exploit

131 results · Feed

  • Medium 6.1
    CVE-2024-5848

    Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation

    A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper input validation. User-supplied data is directly included in server responses from vulnerable service endpoints without proper sanitization or encoding, allo…

    WSO2 WSO2 API Manager WSO2 Open Banking AM
  • Medium 5.4
    CVE-2024-0392

    Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests that can trigger state-changing operatio…

    WSO2 WSO2 Enterprise Integrator
  • Medium 5.6
    CVE-2024-2321

    Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token

    An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are …

    WSO2 WSO2 API Manager WSO2 Identity Server org.wso2.am:am-parent Maven
  • Medium 4.8
    CVE-2023-6911

    WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability

    Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Enterprise Integrator Maven
  • Medium 5.3
    CVE-2023-6839

    Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specif…

    WSO2 WSO2 API Manager
  • Medium 6.1
    CVE-2023-6838

    Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be p…

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 IS as Key Manager
  • High 8.5
    CVE-2023-6837

    Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation

    Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: * An IDP configured for federated authenti…

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Identity Server as Key Manager Maven
  • Medium 4.6
    CVE-2023-6836

    WSO2 products vulnerable to XML External Entity attack

    Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Enterprise Integrator Maven
  • Medium 4.3
    CVE-2023-6835

    WSO2 API Manager allows attackers to change the API rating

    Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

    WSO2 WSO2 API Manager WSO2 IoT Server org.wso2.carbon.apimgt:forum Maven
  • Low 3.5
    CVE-2022-4521

    WSO2 carbon-registry Request Parameter cross site scripting

    A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profile_menu leads to cross s…

    WSO2 carbon-registry org.wso2.carbon.registry:carbon-registry Maven
  • Low 3.5
    CVE-2022-4520

    WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting

    A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSea…

    WSO2 carbon-registry org.wso2.carbon.registry:carbon-registry Maven