WSO2 Open Banking AM vulnerabilities
16 known vulnerabilities in WSO2 Open Banking AM from WSO2. 16 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.4 Critical severity
WSO2 API Manager: Improper Authorization
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful ex
- 8.3 High severity
WSO2 API Manager: Server-Side Request Forgery
Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resour
- 9.1 Critical severity
WSO2 Enterprise Integrator: Improper Neutralization of Special Elements used in an OS Command
The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exp
- 8.4 High severity
WSO2 Open Banking AM: Improper Neutralization of Special Elements used in an OS Command
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enabl
- 9.4 Critical severity
WSO2 Identity Server: Protection Mechanism Failure
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass
- 7.5 High severity
WSO2 Enterprise Integrator: Protection Mechanism Failure
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authenti
- 9.1 Critical severity
WSO2 API Manager: Improper Restriction of XML External Entity Reference
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to
- 9.8 Critical severity
WSO2 API Manager: Missing Authentication for Critical Functionality
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default con
- 8.8 High severity
WSO2 Open Banking AM: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax c
- 7.2 High severity
WSO2 Micro Integrator: Improper Control of Generation of Code
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration run
- 7.2 High severity
WSO2 API Manager: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-co
- 9.1 Critical severity
WSO2 Enterprise Integrator: Improper Restriction of XML External Entity Reference
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successf
- 9.8 Critical severity
WSO2 API Manager: Incorrect Authorization
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability
- 7.2 High severity
WSO2 API Manager: Improper Control of Generation of Code
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a
- 9.8 Critical severity
WSO2 API Manager: Incorrect Authorization
An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exploit this vulnerability to reset the password of any user account, leading to a
- 9.1 Critical severity
WSO2 API Manager: Improper Restriction of XML External Entity Reference
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attack