Wso2 Universal Gateway

Vulnerabilities related to Wso2 Universal Gateway 13

• Medium 4.8 When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of... CVE-2025-1397 Nov 3, 15:07
• Medium 4.9 The refresh token grant type in WSO2 products fails to re-validate account status before issuing... CVE-2024-9517 Nov 2, 20:30
• High 8.7 WSO2 API Managerの脆弱性、管理者権限でSQLを操作されるおそれ WSO2 API ManagerのAdmin REST APIで、利用者の入力がSQL文の構造に混ざる脆弱性が見つかりました。管理者権限を持つ利用者が、ブラインドSQLインジェクションでデータベースの情報を推測したり、データベースの可用性に影響を与えたりするおそれがあります。影響を受けるのは4.0.0〜4.4.0などの各版で、修正版は4.0.0.387、4.1.0.251、4.2.0.191、4.3.0.102、4.4.0.66などです。 CVE-2026-2613 Nov 2, 19:11
• Medium 4.4 When an Event Publisher output adapter is configured with properties that are irrelevant to its... CVE-2026-18800 Nov 2, 18:59
• Critical 9.4 WSO2 API Managerに脆弱性2件、修正版が公開 WSO2 API ManagerのSystem REST APIsに、権限の低いユーザーが管理操作を実行できる脆弱性など2件が公表されました。該当版を洗い出して修正版へ更新し、Identity Serverを連携させている環境ではコネクタの版も確認してください。 CVE-2025-11969 Nov 2, 14:53
• Low 3.1 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does... When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does... CVE-2026-3583 Oct 29, 04:21
• Medium 4.9 The Management Console and product files expose sensitive data, including remote log server... Vulnerability reported (CVE-2025-7203). Confidential information can be exposed externally. CVE-2025-7203 Oct 20, 02:17
• Medium 5.4 The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to... Vulnerability reported (CVE-2025-7043). Risk of unauthorized operations or information disclosure. CVE-2025-7043 Oct 20, 02:16
• Medium 4.3 The carbon console accepts user-supplied XML input without sufficiently encoding potentially... Cross-site scripting reported (CVE-2025-6623). Risk of unauthorized operations or information disclosure. CVE-2025-6623 Oct 20, 02:16
• Medium 6.5 Tokens associated with user sessions are not revoked when the corresponding user session is... Vulnerability reported (CVE-2025-13173). Risk of unauthorized operations or information disclosure. CVE-2025-13173 Oct 20, 02:16
• High 8.7 The XML and schema validation functionalities within the SchemaValidator Mediator process XML... Vulnerability reported (CVE-2026-3415). Confidential information can be exposed externally. CVE-2026-3415 Aug 7, 07:17
• Medium 5.4 Vulnerability in Wso2 Api Control Plane CVE-2026-0637 Aug 6, 17:16
• Critical 9.1 Unrestricted File Upload in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 Vulnerability in org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.admin.v1 (CVE-2025-13590). Successful exploitation can lead to full system takeover. Mitigation: upgrade to 9.32.167 or later. CVE-2025-13590 Feb 19, 19:16