Description
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.
This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 Identity Server as Key Manager | 5.3.0 – < 5.3.0.41, 5.5.0 – < 5.5.0.53, 5.6.0 – < 5.6.0.75, 5.7.0 – < 5.7.0.125, 5.9.0 – < 5.9.0.176, 5.10.0 – < 5.10.0.359 | 5.3.0.41 |
| WSO2 | WSO2 Identity Server | 5.2.0 – < 5.2.0.34, 5.3.0 – < 5.3.0.36, 5.4.0 – < 5.4.0.34, 5.4.1 – < 5.4.1.38, 5.5.0 – < 5.5.0.52, 5.6.0 – < 5.6.0.60, 5.7.0 – < 5.7.0.126, 5.8.0 – < 5.8.0.110, 5.9.0 – < 5.9.0.169, 5.10.0 – < 5.10.0.369, 5.11.0 – < 5.11.0.413, 6.0.0 – < 6.0.0.244, 6.1.0 – < 6.1.0.243, 7.0.0 – < 7.0.0.118, 7.1.0 –… | 5.2.0.34 |
| WSO2 | WSO2 Open Banking KM | 1.4.0 – < 1.4.0.133, 1.5.0 – < 1.5.0.123 | 1.4.0.133 |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – < 2.0.0.409 | 2.0.0.409 |
| WSO2 | WSO2 Open Banking AM | 1.4.0 – < 1.4.0.139, 1.5.0 – < 1.5.0.140, 2.0.0 – < 2.0.0.389 | 1.4.0.139 |
| WSO2 | WSO2 API Manager | 2.0.0 – < 2.0.0.31, 2.1.0 – < 2.1.0.40, 2.2.0 – < 2.2.0.59, 2.5.0 – < 2.5.0.85, 2.6.0 – < 2.6.0.146, 3.0.0 – < 3.0.0.176, 3.1.0 – < 3.1.0.340, 3.2.0 – < 3.2.0.441, 3.2.1 – < 3.2.1.61, 4.0.0 – < 4.0.0.361, 4.1.0 – < 4.1.0.224, 4.2.0 – < 4.2.0.162, 4.3.0 – < 4.3.0.75, 4.4.0 – < 4.4.0.39, 4.5.0 – < 4.… | 2.0.0.31 |
| WSO2 | WSO2 Identity Server Analytics | 5.2.0 – < 5.2.0.19, 5.3.0 – < 5.3.0.17, 5.5.0 – < 5.5.0.31, 5.6.0 – < 5.6.0.38 | 5.2.0.19 |
| WSO2 | API Manager Analytics | 2.0.0 – < 2.0.0.14, 2.1.0 – < 2.1.0.19, 2.2.0 – < 2.2.0.30, 2.5.0 – < 2.5.0.39 | 2.0.0.14 |
| WSO2 | WSO2 Enterprise Integrator | 6.2.0 – < 6.2.0.62, 6.3.0 – < 6.3.0.70 | 6.2.0.62 |
| WSO2 | WSO2 Enterprise Service Bus Analytics | 5.0.0 – < 5.0.0.13 | 5.0.0.13 |
| WSO2 | WSO2 Data Analytics Server | 3.1.0 – < 3.1.0.20, 3.2.0 – < 3.2.0.33 | 3.1.0.20 |
| WSO2 | WSO2 Enterprise Mobility Manager | 2.2.0 – < 2.2.0.28 | 2.2.0.28 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.22 | 4.5.0.22 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.24 | 4.5.0.24 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.22 | 4.5.0.22 |
| WSO2 | org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector | 2.0.10 – < 2.0.10.1, 2.0.15 – < 2.0.15.1, 2.0.21 – < 2.0.21.1, 2.0.22 – < 2.0.22.1, 2.1.12 – < 2.1.12.1, 2.1 – < 2.1.1972, 2.2 – < 2.2.24, 2.2 – < 2.2.25, 3.1.0 – < 3.1.0.74, 3.3.6 – < 3.3.6.7, 3.3.26 – < 3.3.26.2, 3.3.35 – < 3.3.35.1 | 2.0.10.1 |
| WSO2 | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util | 6.7.206 – < 6.7.206.567, 6.7.210 – < 6.7.210.63, 9.0.174 – < 9.0.174.522, 9.20.74 – < 9.20.74.379, 9.28.116 – < 9.28.116.360, 9.29.120 – < 9.29.120.184, 9.30.67 – < 9.30.67.109, 9.31.86 – < 9.31.86.71 | 6.7.206.567 |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.4.7 – < 4.4.7.6, 4.4.9 – < 4.4.9.11, 4.4.11 – < 4.4.11.9, 4.4.26 – < 4.4.26.12, 4.4.35 – < 4.4.35.44, 4.5.1 – < 4.5.1.43, 4.6.0 – < 4.6.0.1990, 4.6.1 – < 4.6.1.149, 4.6.2 – < 4.6.2.667, 4.6.3 – < 4.6.3.36, 4.6.4 – < 4.6.4.14, 4.7.1 – < 4.7.1.68, 4.8.1 – < 4.8.1.39, 4.9.0 – < 4.9.0.99, 4.9.26 – < … | 4.4.7.6 |
| WSO2 | org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt | 5.2.0 – < 5.2.0.4, 5.2.2 – < 5.2.2.21, 5.7.5 – < 5.7.5.18, 5.11.148 – < 5.11.148.19, 5.11.256 – < 5.11.256.21, 5.12.153 – < 5.12.153.63, 5.12.387 – < 5.12.387.46, 5.14.97 – < 5.14.97.89, 5.17.5 – < 5.17.5.317, 5.17.118 – < 5.17.118.17, 5.18.187 – < 5.18.187.309, 5.18.248 – < 5.18.248.30, 5.23.8 – <… | 5.2.0.4 |
| WSO2 | org.wso2.carbon:org.wso2.carbon.server.admin | 4.4.7 – < 4.4.7.6, 4.4.9 – < 4.4.9.11, 4.4.11 – < 4.4.11.9, 4.4.26 – < 4.4.26.12, 4.4.32 – < 4.4.32.16, 4.4.35 – < 4.4.35.44, 4.5.1 – < 4.5.1.43, 4.6.0 – < 4.6.0.1990, 4.6.1 – < 4.6.1.149, 4.6.2 – < 4.6.2.667, 4.6.3 – < 4.6.3.36, 4.6.4 – < 4.6.4.14, 4.7.1 – < 4.7.1.68, 4.8.1 – < 4.8.1.39, 4.9.0 – <… | 4.4.7.6 |
| WSO2 | org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow | 5.1.1 – < 5.1.1.1, 5.1.2 – < 5.1.2.1, 5.1.5 – < 5.1.5.1, 5.3.3 – < 5.3.3.1, 5.4.0 – < 5.4.0.4, 5.4.1 – < 5.4.1.5, 5.6.0 – < 5.6.0.1 | 5.1.1.1 |