WSO2 Carbon API Management Implementation vulnerabilities
6 known vulnerabilities in WSO2 Carbon API Management Implementation from WSO2. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
WSO2 API Manager: Improper Neutralization of Special Elements used in an SQL Command
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabl
- 9.1 Critical severity
WSO2 API Manager: Unrestricted Upload of File with Dangerous Type
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access wit
- 8.7 High severity
WSO2 API Manager: Improper Restriction of Recursive Entity References in DTDs
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during
- 9.0 Critical severity
WSO2 API Manager: Improper Access Control
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows
- 8.8 High severity
WSO2 API Control Plane: Improper Preservation of Permissions
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, poten
- 7.5 High severity
WSO2 API Manager: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inj