Description
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.
The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 API Manager | 4.1.0 – < 4.1.0.242, 4.2.0 – < 4.2.0.182, 4.3.0 – < 4.3.0.93, 4.4.0 – < 4.4.0.57, 4.5.0 – < 4.5.0.41, 4.6.0 – < 4.6.0.6 | 4.1.0.242 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.42, 4.6.0 – < 4.6.0.7 | 4.5.0.42 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.40, 4.6.0 – < 4.6.0.6 | 4.5.0.40 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.40, 4.6.0 – < 4.6.0.6 | 4.5.0.40 |
| WSO2 | WSO2 Carbon API Management Implementation | 9.20.74 – < 9.20.74.388, 9.28.116 – < 9.28.116.395, 9.29.120 – < 9.29.120.213, 9.30.67 – < 9.30.67.135, 9.31.86 – < 9.31.86.108, 9.32.147 – < 9.32.147.5 | 9.20.74.388 |
| WSO2 | WSO2 Carbon API Manager Rest API Utility | 9.20.74 – < 9.20.74.388, 9.28.116 – < 9.28.116.395, 9.29.120 – < 9.29.120.213, 9.30.67 – < 9.30.67.135, 9.31.86 – < 9.31.86.108, 9.32.147 – < 9.32.147.5 | 9.20.74.388 |