CVSS 9.8 · Critical EPSS 0,48%
Kerentanan Improper Privilege Management pada wso2 api control plane, wso2 api manager +2 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut CNA.
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| wso2 | api control plane | Versi 4.5.0 hingga sebelum 4.5.0.49 |
| wso2 | api control plane | Versi 4.6.0 hingga sebelum 4.6.0.13 |
| wso2 | api manager | Versi 4.0.0 hingga sebelum 4.0.0.384 |
| wso2 | api manager | Versi 4.1.0 hingga sebelum 4.1.0.248 |
| wso2 | api manager | Versi 4.2.0 hingga sebelum 4.2.0.188 |
| wso2 | api manager | Versi 4.3.0 hingga sebelum 4.3.0.99 |
| wso2 | api manager | Versi 4.4.0 hingga sebelum 4.4.0.63 |
| wso2 | api manager | Versi 4.5.0 hingga sebelum 4.5.0.48 |
| wso2 | api manager | Versi 4.6.0 hingga sebelum 4.6.0.12 |
| wso2 | traffic manager | Versi 4.5.0 hingga sebelum 4.5.0.47 |
| wso2 | traffic manager | Versi 4.6.0 hingga sebelum 4.6.0.12 |
| wso2 | universal gateway | Versi 4.5.0 hingga sebelum 4.5.0.48 |
| wso2 | universal gateway | Versi 4.6.0 hingga sebelum 4.6.0.12 |