Description
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.
Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 Open Banking AM | 2.0.0 – < 2.0.0.398 | 2.0.0.398 |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – < 2.0.0.418 | 2.0.0.418 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.34, 4.6.0 – < 4.6.0.1 | 4.5.0.34 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.34, 4.6.0 – < 4.6.0.1 | 4.5.0.34 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.36, 4.6.0 – < 4.6.0.1 | 4.5.0.36 |
| WSO2 | WSO2 API Manager | 3.1.0 – < 3.1.0.349, 3.2.0 – < 3.2.0.453, 3.2.1 – < 3.2.1.73, 4.0.0 – < 4.0.0.373, 4.1.0 – < 4.1.0.236, 4.2.0 – < 4.2.0.176, 4.3.0 – < 4.3.0.88, 4.4.0 – < 4.4.0.52, 4.5.0 – < 4.5.0.35, 4.6.0 – < 4.6.0.1 | 3.1.0.349 |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 – < 5.10.0.369 | 5.10.0.369 |
| WSO2 | WSO2 Identity Server | 5.10.0 – < 5.10.0.378, 5.11.0 – < 5.11.0.425, 6.0.0 – < 6.0.0.252, 6.1.0 – < 6.1.0.253, 7.0.0 – < 7.0.0.130, 7.1.0 – < 7.1.0.38, 7.2.0 – < 7.2.0.1 | 5.10.0.378 |