Description
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.
A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 – < 3.2.0.437, 3.2.1 – < 3.2.1.57, 4.0.0 – < 4.0.0.357, 4.1.0 – < 4.1.0.221, 4.2.0 – < 4.2.0.159, 4.3.0 – < 4.3.0.72, 4.4.0 – < 4.4.0.35, 4.5.0 – < 4.5.0.19 | 3.2.0.437 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.20 | 4.5.0.20 |