Wso2 Api Manager
Related 29slug: wso2-api-manager
No explanation yet for this tag.
Vulnerabilities related to Wso2 Api Manager 29
- Critical 9.8 WSO2 API Managerに権限昇格の脆弱性、修正版あり WSO2 API ManagerでIdentity ServerをResident Key Managerにしている環境で、セルフ登録したユーザーがシステム用のAPIを使えてしまう脆弱性です。該当する構成か確認し、IS・APIM・コネクターを更新してください。 CVE-2026-4052
- Medium 6.1 The authentication endpoint does not properly encode user-supplied input before rendering it... CVE-2025-5769
- Medium 4.8 When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of... CVE-2025-1397
- Medium 4.3 The error handling implementation fails to properly sanitize or validate user-supplied input... CVE-2024-12139
- Medium 4.9 The refresh token grant type in WSO2 products fails to re-validate account status before issuing... CVE-2024-9517
- Medium 5.4 The affected components accept user-supplied input for constructing redirection URLs without... CVE-2024-2372
- Medium 4.8 The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users... CVE-2025-12544
- High 8.7 WSO2 API Managerの脆弱性、管理者権限でSQLを操作されるおそれ WSO2 API ManagerのAdmin REST APIで、利用者の入力がSQL文の構造に混ざる脆弱性が見つかりました。管理者権限を持つ利用者が、ブラインドSQLインジェクションでデータベースの情報を推測したり、データベースの可用性に影響を与えたりするおそれがあります。影響を受けるのは4.0.0〜4.4.0などの各版で、修正版は4.0.0.387、4.1.0.251、4.2.0.191、4.3.0.102、4.4.0.66などです。 CVE-2026-2613
- Medium 4.4 When an Event Publisher output adapter is configured with properties that are irrelevant to its... CVE-2026-18800
- Medium 4.6 The user search function within the management console fails to properly encode user-supplied... CVE-2024-7075
- Medium 4.8 The account lock feature fails to correctly enforce account lockouts on the primary user store... CVE-2024-5617
- Critical 9.4 WSO2 API Managerに脆弱性2件、修正版が公開 WSO2 API ManagerのSystem REST APIsに、権限の低いユーザーが管理操作を実行できる脆弱性など2件が公表されました。該当版を洗い出して修正版へ更新し、Identity Serverを連携させている環境ではコネクタの版も確認してください。 CVE-2025-11969
- Low 3.1 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does... When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does... CVE-2026-3583
- Medium 6.1 The authentication endpoint generates an error message that includes reflected data directly from... CVE-2026-11854
- High 8.3 WSO2製品に認証不要でサーバーの代わりに内部リソースへ接続される脆弱性 WSO2のAPI Manager、Identity Serverなど複数の製品に、サーバーに任意のネットワーク先へリクエストを送らせる脆弱性(CVE-2025-14260)が見つかりました。認証なしで攻撃されるおそれがあり、CVSSは8.3です。修正版が公開されているため、利用中の製品と版を確認し、修正版へ更新してください。 CVE-2025-14260
- Medium 5.8 When a WSO2 product is configured to use an external user store, the system fails to adequately... CVE-2024-7478
- Medium 4.0 The product failed to enforce validation constraints on user-supplied input in URL parameters,... CVE-2024-6423
- Medium 6.1 The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for... CVE-2024-5139
- Medium 5.4 The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it... CVE-2024-4989
- Medium 4.8 The RemoteUserStoreManagerService does not sufficiently validate password change attempts when... CVE-2024-2323
- Medium 4.9 The Management Console and product files expose sensitive data, including remote log server... Vulnerability reported (CVE-2025-7203). Confidential information can be exposed externally. CVE-2025-7203
- Medium 5.4 The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to... Vulnerability reported (CVE-2025-7043). Risk of unauthorized operations or information disclosure. CVE-2025-7043
- Medium 4.3 The carbon console accepts user-supplied XML input without sufficiently encoding potentially... Cross-site scripting reported (CVE-2025-6623). Risk of unauthorized operations or information disclosure. CVE-2025-6623
- Medium 6.5 Tokens associated with user sessions are not revoked when the corresponding user session is... Vulnerability reported (CVE-2025-13173). Risk of unauthorized operations or information disclosure. CVE-2025-13173
- Low 2.7 The software accepts user-supplied data without sufficient validation, allowing for the injection... Code injection reported (CVE-2024-4412). Risk of unauthorized operations or information disclosure. CVE-2024-4412
- Critical 9.1 OS Command Injection in Management Console CVE-2024-4457
- High 8.7 The XML and schema validation functionalities within the SchemaValidator Mediator process XML... Vulnerability reported (CVE-2026-3415). Confidential information can be exposed externally. CVE-2026-3415
- Medium 5.4 Vulnerability in Wso2 Api Control Plane CVE-2026-0637
- Critical 9.1 Unrestricted File Upload in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 Vulnerability in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (CVE-2025-13590). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 9.32.167 or later. CVE-2025-13590