CVE-2024-3511

Katalog CVE

CVSS 4.3 · Medium EPSS 0,21%

Kerentanan Incorrect Authorization pada wso2 api manager, wso2 enterprise integrator +4 lainnya. Skor CVSS 3.1 4.3 (Medium) menurut CNA.

Deskripsi (NVD)

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.

Rincian

Terbit di NVD

23 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber CNA
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/ advisory vendor