Wso2 Api Control Plane
Related 16slug: wso2-api-control-plane
No explanation yet for this tag.
Vulnerabilities related to Wso2 Api Control Plane 16
- Critical 9.8 WSO2 API Managerに権限昇格の脆弱性、修正版あり WSO2 API ManagerでIdentity ServerをResident Key Managerにしている環境で、セルフ登録したユーザーがシステム用のAPIを使えてしまう脆弱性です。該当する構成か確認し、IS・APIM・コネクターを更新してください。 CVE-2026-4052
- Medium 6.1 The authentication endpoint does not properly encode user-supplied input before rendering it... CVE-2025-5769
- Medium 4.8 When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of... CVE-2025-1397
- Medium 4.9 The refresh token grant type in WSO2 products fails to re-validate account status before issuing... CVE-2024-9517
- High 8.7 WSO2 API Managerの脆弱性、管理者権限でSQLを操作されるおそれ WSO2 API ManagerのAdmin REST APIで、利用者の入力がSQL文の構造に混ざる脆弱性が見つかりました。管理者権限を持つ利用者が、ブラインドSQLインジェクションでデータベースの情報を推測したり、データベースの可用性に影響を与えたりするおそれがあります。影響を受けるのは4.0.0〜4.4.0などの各版で、修正版は4.0.0.387、4.1.0.251、4.2.0.191、4.3.0.102、4.4.0.66などです。 CVE-2026-2613
- Medium 4.4 When an Event Publisher output adapter is configured with properties that are irrelevant to its... CVE-2026-18800
- Critical 9.4 WSO2 API Managerに脆弱性2件、修正版が公開 WSO2 API ManagerのSystem REST APIsに、権限の低いユーザーが管理操作を実行できる脆弱性など2件が公表されました。該当版を洗い出して修正版へ更新し、Identity Serverを連携させている環境ではコネクタの版も確認してください。 CVE-2025-11969
- Low 3.1 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does... When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does... CVE-2026-3583
- Medium 6.1 The authentication endpoint generates an error message that includes reflected data directly from... CVE-2026-11854
- Medium 4.9 The Management Console and product files expose sensitive data, including remote log server... Vulnerability reported (CVE-2025-7203). Confidential information can be exposed externally. CVE-2025-7203
- Medium 5.4 The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to... Vulnerability reported (CVE-2025-7043). Risk of unauthorized operations or information disclosure. CVE-2025-7043
- Medium 4.3 The carbon console accepts user-supplied XML input without sufficiently encoding potentially... Cross-site scripting reported (CVE-2025-6623). Risk of unauthorized operations or information disclosure. CVE-2025-6623
- Medium 6.5 Tokens associated with user sessions are not revoked when the corresponding user session is... Vulnerability reported (CVE-2025-13173). Risk of unauthorized operations or information disclosure. CVE-2025-13173
- High 8.7 The XML and schema validation functionalities within the SchemaValidator Mediator process XML... Vulnerability reported (CVE-2026-3415). Confidential information can be exposed externally. CVE-2026-3415
- Medium 5.4 Vulnerability in Wso2 Api Control Plane CVE-2026-0637
- Critical 9.1 Unrestricted File Upload in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 Vulnerability in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (CVE-2025-13590). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 9.32.167 or later. CVE-2025-13590