WSO2 Carbon API Manager Rest API Utility vulnerabilities
5 known vulnerabilities in WSO2 Carbon API Manager Rest API Utility from WSO2. 5 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.4 Critical severity
WSO2 API Manager: Improper Authorization
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful ex
- 9.0 Critical severity
WSO2 API Manager: Improper Access Control
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows
- 10.0 Critical severity
WSO2 Multiple Products Path Traversal Exploited
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized acces
- 9.8 Critical severity
WSO2 API Manager: Improper Privilege Management
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentiall
- 8.8 High severity
WSO2 API Control Plane: Improper Preservation of Permissions
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This same vulnerability also affects Internal Service APIs, poten