WSO2 WSO2 API Manager
80 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-6423 | 3.1.0 – < 3.1.0.313 ; 3.2.0 – < 3.2.0.406 ; 3.2.1 – < 3.2.1.30 ; … | Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage | MEDIUM 4.0 | 0.1 % | ||
| CVE-2024-7478 | 3.1.0 – < 3.1.0.310 ; 3.2.0 – < 3.2.0.401 ; 3.2.1 – < 3.2.1.26 ; … | Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery | MEDIUM 5.8 | 0.2 % | ||
| CVE-2024-4989 | 4.1.0 – < 4.1.0.153 ; 4.2.0 – < 4.2.0.105 ; 4.3.0 – < 4.3.0.20 | Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks | MEDIUM 5.4 | 0.2 % | ||
| CVE-2024-5139 | 3.1.0 – < 3.1.0.286 ; 3.2.0 – < 3.2.0.376 ; 3.2.1 – < 3.2.1.10 ; … | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection | MEDIUM 6.1 | 0.2 % | ||
| CVE-2024-2323 | 3.1.0 – < 3.1.0.268 ; 3.2.0 – < 3.2.0.354 | Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery | MEDIUM 4.8 | 0.2 % | ||
| CVE-2024-4412 | 3.1.0 – < 3.1.0.276 ; 3.2.0 – < 3.2.0.366 ; 3.2.1 – < 3.2.1.18 ; … | Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations | LOW 2.7 | 0.4 % | ||
| CVE-2025-13173 | 3.1.0 – < 3.1.0.352 ; 3.2.0 – < 3.2.0.456 ; 3.2.1 – < 3.2.1.81 ; … | Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session Termination | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-7203 | 4.3.0 – < 4.3.0.97 ; 4.4.0 – < 4.4.0.61 ; 4.5.0 – < 4.5.0.46 ; … | Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials | MEDIUM 4.9 | 0.2 % | ||
| CVE-2025-7043 | 3.2.0 – < 3.2.0.434 ; 3.2.1 – < 3.2.1.54 ; 4.1.0 – < 4.1.0.218 ; … | Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption | MEDIUM 5.4 | 0.2 % | ||
| CVE-2025-6623 | 3.2.0 – < 3.2.0.433 ; 3.2.1 – < 3.2.1.53 ; 4.1.0 – < 4.1.0.215 ; … | Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-4457 | 3.1.0 – < 3.1.0.275 ; 3.2.0 – < 3.2.0.365 ; 3.2.1 – < 3.2.1.19 ; … | Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-5802 | 3.1.0 – < 3.1.0.354 ; 3.2.0 – < 3.2.0.458 ; 3.2.0 – < 3.2.0.478 ; … | Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-4103 | 3.2.0 – < 3.2.0.470 ; 3.2.1 – < 3.2.1.89 ; 4.1.0 – < 4.1.0.254 ; … | Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution | MEDIUM 6.4 | 0.3 % | ||
| CVE-2026-3096 | 3.2.0 – < 3.2.0.468 ; 3.2.1 – < 3.2.1.87 ; 4.1.0 – < 4.1.0.252 ; … | Reverse Tabnabbing via New Tab Navigation in Multiple WSO2 Products Allows Phishing and Credential Theft | MEDIUM 4.7 | 0.3 % | ||
| CVE-2025-12737 | | Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution | HIGH 8.4 | 0.4 % | ||
| CVE-2026-3416 | 4.1.0 – < 4.1.0.253 ; 4.2.0 – < 4.2.0.193 ; 4.3.0 – < 4.3.0.104 ; … | Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads | HIGH 7.5 | 0.4 % | ||
| CVE-2026-3418 | 4.4.0 – < 4.4.0.67 ; 4.5.0 – < 4.5.0.52 ; 4.6.0 – < 4.6.0.16 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution | CRITICAL 9.1 | 0.8 % | ||
| CVE-2026-3415 | 3.2.0 – < 3.2.0.472 ; 3.2.1 – < 3.2.1.91 ; 4.1.0 – < 4.1.0.254 ; … | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2025-14561 | 4.1.0 – < 4.1.0.242 ; 4.2.0 – < 4.2.0.182 ; 4.3.0 – < 4.3.0.93 ; … | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations | CRITICAL 9.0 | 0.4 % | ||
| CVE-2025-6508 | 4.1.0 – < 4.1.0.212 ; 4.2.0 – < 4.2.0.183 | User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended R… | MEDIUM 4.3 | 0.3 % | ||
| CVE-2024-6541 | 3.2.0 – < 3.2.0.394 ; 3.2.1 – < 3.2.1.21 ; 4.0.0 – < 4.0.0.311 ; … | Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products | MEDIUM 6.8 | 0.3 % | ||
| CVE-2026-5430 | 4.1.0 – < 4.1.0.257 ; 4.2.0 – < 4.2.0.197 ; 4.3.0 – < 4.3.0.108 ; … | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | CRITICAL 10.0 | 22 % | KEV | |
| CVE-2026-1728 | 4.0.0 – < 4.0.0.384 ; 4.1.0 – < 4.1.0.248 ; 4.2.0 – < 4.2.0.188 ; … | Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-15039 | 2.6.0 – < 2.6.0.150 ; 3.0.0 – < 3.0.0.180 ; 3.1.0 – < 3.1.0.356 ; … | Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products | CRITICAL 9.4 | 0.7 % | ||
| CVE-2026-0637 | 3.1.0 – < 3.1.0.357 ; 3.2.0 – < 3.2.0.465 ; 3.2.1 – < 3.2.1.84 ; … | Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products | MEDIUM 4.4 | 0.2 % | ||
| CVE-2025-13394 | 3.1.0 – < 3.1.0.352 ; 3.2.0 – < 3.2.0.456 ; 3.2.1 – < 3.2.1.75 ; … | Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions | MEDIUM 5.4 | 0.1 % | ||
| CVE-2025-13736 | 3.1.0 – < 3.1.0.351 ; 3.2.0 – < 3.2.0.455 ; 4.0.0 – < 4.0.0.375 | Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery | LOW 3.7 | 0.3 % | ||
| CVE-2024-10302 | 3.1.0 – < 3.1.0.331 ; 3.2.0 – < 3.2.0.427 ; 3.2.1 – < 3.2.1.39 ; … | Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure | MEDIUM 5.8 | 0.3 % | ||
| CVE-2024-6832 | 3.1.0 – < 3.1.0.296 ; 3.2.0 – < 3.2.0.386 ; 3.2.0 – < 3.2.0.455 ; … | Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks | HIGH 7.5 | 0.4 % | ||
| CVE-2024-8995 | 3.1.0 – < 3.1.0.320 ; 3.2.0 – < 3.2.0.413 ; 3.2.1 – < 3.2.1.90 ; … | Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access | MEDIUM 4.9 | 0.2 % | ||
| CVE-2026-2445 | 4.2.0 – < 4.2.0.195 ; 4.3.0 – < 4.3.0.106 ; 4.4.0 – < 4.4.0.70 ; … | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-4249 | 3.2.0 – < 3.2.0.470 ; 3.2.1 – < 3.2.1.89 ; 4.0.0 – < 4.0.0.390 ; … | Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption | HIGH 8.6 | 0.6 % | ||
| CVE-2025-8591 | 3.1.0 – < 3.1.0.355 ; 3.2.0 – < 3.2.0.459 ; 3.2.1 – < 3.2.1.78 ; … | Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-1248 | 3.0.0 – < 3.0.0.153 ; 3.1.0 – < 3.1.0.267 ; 3.2.0 – < 3.2.0.351 ; … | Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-13475 | 3.2.0 – < 3.2.0.457 ; 3.2.1 – < 3.2.1.76 | Cross-Tenant Access via Application Consent Mismanagement in Multiple WSO2 Products Allows Unauthorized Data Exposure | HIGH 7.3 | 0.3 % | ||
| CVE-2026-2053 | 3.1.0 – < 3.1.0.360 ; 3.2.0 – < 3.2.0.465 ; 3.2.1 – < 3.2.1.84 ; … | Unauthenticated Server-Side Request Forgery via WS-Addressing in WSO2 API Manager | CRITICAL 10.0 | 0.4 % | ||
| CVE-2025-8325 | 3.2.0 – < 3.2.0.435 ; 3.2.1 – < 3.2.1.55 ; 4.0.0 – < 4.0.0.355 ; … | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations | HIGH 8.8 | 0.2 % | ||
| CVE-2025-8154 | 4.1.0 – < 4.1.0.218 ; 4.2.0 – < 4.2.0.164 ; 4.3.0 – < 4.3.0.74 ; … | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation | HIGH 7.5 | 0.2 % | ||
| CVE-2025-6024 | 3.1.0 – < 3.1.0.351 ; 3.2.0 – < 3.2.0.455 ; 3.2.1 – < 3.2.1.74 ; … | Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites | MEDIUM 6.1 | 0.2 % | ||
| CVE-2024-10242 | 3.2.0 – < 3.2.0.401 ; 4.0.0 – < 4.0.0.318 | Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection | MEDIUM 6.1 | 0.2 % | ||
| CVE-2024-8010 | 3.2.0 – < 3.2.0.397 ; 3.2.1 – < 3.2.1.27 ; 4.0.0 – < 4.0.0.310 ; … | XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files | HIGH 7.5 | 0.3 % | ||
| CVE-2024-4867 | 3.2.0 – < 3.2.0.408 ; 3.2.1 – < 3.2.1.32 ; 4.0.0 – < 4.0.0.293 ; … | Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval | MEDIUM 5.4 | 0.2 % | ||
| CVE-2024-2374 | 3.1.0 – < 3.1.0.278 ; 3.2.0 – < 3.2.0.368 ; 4.0.0 – < 4.0.0.280 ; … | XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service | CRITICAL 9.1 | 0.4 % | ||
| CVE-2024-1524 | 4.2.0 – < 4.2.0.108 | A local user can be impersonated when using federated authentication with Silent JIT Provisioning. | HIGH 8.1 | 0.3 % | ||
| CVE-2025-13590 | 4.2.0 – < 4.2.0.179 ; 4.3.0 – < 4.3.0.91 ; 4.4.0 – < 4.4.0.55 ; … | Authenticated arbitrary file upload via a System REST API requiring administrator permission. | CRITICAL 9.1 | 0.8 % | ||
| CVE-2025-9312 | 2.2.0 – < 2.2.0.58 ; 2.5.0 – < 2.5.0.84 ; 2.6.0 – < 2.6.0.145 ; … | Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products | CRITICAL 9.8 | 0.3 % | ||
| CVE-2025-6670 | | Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services | HIGH 8.8 | 0.2 % | ||
| CVE-2025-10853 | 3.1.0 – < 3.1.0.344 ; 3.2.0 – < 3.2.0.445 ; 3.2.1 – < 3.2.1.65 ; … | Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-5770 | 4.2.0 – < 4.2.0.150 ; 4.3.0 – < 4.3.0.63 ; 4.4.0 – < 4.4.0.26 ; … | Reflected Cross-Site Scripting (XSS) in Authentication Endpoints of Multiple WSO2 Products | MEDIUM 6.1 | 0.2 % | ||
| CVE-2025-11093 | 3.1.0 – < 3.1.0.345 ; 3.2.0 – < 3.2.0.446 ; 3.2.1 – < 3.2.1.66 ; … | Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS) | HIGH 8.4 | 0.5 % | ||
| CVE-2025-10907 | 3.1.0 – < 3.1.0.345 ; 3.2.0 – < 3.2.0.448 ; 3.2.1 – < 3.2.1.66 ; … | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution | HIGH 8.4 | 0.6 % | ||
| CVE-2025-10713 | 3.1.0 – < 3.1.0.344 ; 3.2.0 – < 3.2.0.445 ; 3.2.1 – < 3.2.1.65 ; … | XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration | CRITICAL 9.1 | 0.5 % | ||
| CVE-2025-3125 | 3.2.0 – < 3.2.0.421 ; 3.2.1 – < 3.2.1.41 ; 4.0.0 – < 4.0.0.342 ; … | Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution | HIGH 7.2 | 0.9 % | ||
| CVE-2025-5605 | 3.1.0 – < 3.1.0.334 ; 3.2.0 – < 3.2.0.430 ; 3.2.1 – < 3.2.1.48 ; … | Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure | MEDIUM 5.3 | 0.9 % | ||
| CVE-2025-5350 | 3.1.0 – < 3.1.0.332 ; 3.2.0 – < 3.2.0.428 ; 3.2.1 – < 3.2.1.47 ; … | SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-9152 | 3.2.0 – < 3.2.0.437 ; 3.2.1 – < 3.2.1.57 ; 4.0.0 – < 4.0.0.357 ; … | Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint | CRITICAL 9.8 | 0.7 % | ||
| CVE-2025-9804 | | Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs | CRITICAL 9.6 | 0.6 % | ||
| CVE-2025-10611 | 2.1.0 – < 2.1.0.42 ; 2.2.0 – < 2.2.0.61 ; 2.5.0 – < 2.5.0.87 ; … | Potential Broken Access Control in Multiple WSO2 Products via System REST APIs | CRITICAL 9.8 | 0.8 % | ||
| CVE-2024-6429 | 3.2.0 – < 3.2.0.409 ; 3.2.1 – < 3.2.1.33 ; 4.0.0 – < 4.0.0.327 ; … | Content Spoofing in Multiple WSO2 Products via Error Message Injection | MEDIUM 4.3 | 0.2 % | ||
| CVE-2025-5717 | 3.0.0 – < 3.0.0.174 ; 3.1.0 – < 3.1.0.330 ; 3.2.0 – < 3.2.0.426 ; … | Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service | HIGH 7.2 | 0.7 % | ||
| CVE-2025-4760 | 3.2.0 – < 3.2.0.428 ; 3.2.1 – < 3.2.1.48 ; 4.1.0 – < 4.1.0.209 ; … | Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher | MEDIUM 4.8 | 0.2 % | ||
| CVE-2024-4598 | 3.2.0 – < 3.2.0.422 ; 3.2.1 – < 3.2.1.42 ; 4.1.0 – < 4.1.0.152 ; … | Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator | MEDIUM 6.5 | 0.3 % | ||
| CVE-2024-3511 | 3.1.0 – < 3.1.0.273 ; 3.2.0 – < 3.2.0.361 ; 3.2.1 – < 3.2.1.13 ; … | Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-1440 | 3.1.0 – < 3.1.0.262 ; 3.2.0 – < 3.2.0.344 ; 4.0.0 – < 4.0.0.296 | Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint | MEDIUM 6.1 | 0.2 % | ||
| CVE-2024-8008 | 3.1.0 – < 3.1.0.305 ; 3.2.0 – < 3.2.0.396 ; 3.2.1 – < 3.2.1.28 ; … | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation | MEDIUM 5.2 | 0.5 % | ||
| CVE-2024-3509 | 3.1.0 – < 3.1.0.275 ; 3.2.0 – < 3.2.0.392 ; 3.2.1 – < 3.2.1.19 ; … | Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor | MEDIUM 4.3 | 0.2 % | ||
| CVE-2024-7074 | 2.0.0 – < 2.0.0.28 ; 2.1.0 – < 2.1.0.38 ; 2.2.0 – < 2.2.0.57 ; … | Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution | MEDIUM 6.8 | 17 % | ||
| CVE-2024-7097 | 2.0.0 – < 2.0.0.29 ; 2.1.0 – < 2.1.0.39 ; 2.2.0 – < 2.2.0.56 ; … | Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup | MEDIUM 4.3 | 0.7 % | ||
| CVE-2024-7096 | 2.0.0 – < 2.0.0.29 ; 2.1.0 – < 2.1.0.39 ; 2.2.0 – < 2.2.0.56 ; … | Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw | MEDIUM 5.4 | 0.7 % | ||
| CVE-2024-5962 | 4.2.0 – < 4.2.0.94 ; 4.3.0 – < 4.3.0.9 | Reflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output Encoding | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-6914 | 2.2.0 – < 2.2.0.55 ; 2.5.0 – < 2.5.0.82 ; 2.6.0 – < 2.6.0.141 ; … | Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover | CRITICAL 9.8 | 0.8 % | ||
| CVE-2025-2905 | < 2.0.0 ; 2.1.0 ; 2.2.0 ; … | An XML External Entity (XXE) vulnerability in Multiple WSO2 Products | CRITICAL 9.1 | 1.3 % | ||
| CVE-2024-5848 | 3.1.0 – < 3.1.0.285 ; 3.2.0 – < 3.2.0.375 ; 3.2.1 – < 3.2.1.10 ; … | Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation | MEDIUM 6.1 | 0.2 % | ||
| CVE-2024-2321 | 4.0.0 – < 4.0.0.275 ; 4.1.0 – < 4.1.0.153 ; 4.2.0 – < 4.2.0.83 | Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token | MEDIUM 5.6 | 0.2 % | ||
| CVE-2023-6911 | 2.2.0.0 – < 2.2.0.1 ; 2.5.0.0 – < 2.5.0.1 ; 2.6.0.0 – < 2.6.0.1 ; … | Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be | MEDIUM 4.8 | 0.4 % | ||
| CVE-2023-6839 | 3.0.0.0 – < 3.0.0.15 ; 3.2.0.0 – < 3.2.0.32 | Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in th | MEDIUM 5.3 | 0.5 % | ||
| CVE-2023-6838 | 3.1.0.0 – < 3.1.0.14 ; 3.2.0.0 – < 3.2.0.10 | Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both auth | MEDIUM 6.1 | 0.4 % | ||
| CVE-2023-6837 | 2.5.0 – < 2.5.0.32 ; 2.6.0 – < 2.6.0.52 ; 3.0.0 – < 3.0.0.50 ; … | Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation | HIGH 8.5 | 0.5 % | ||
| CVE-2023-6836 | 3.0.0.0 – < 3.0.0.1 | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely us | HIGH 7.5 | 0.5 % | ||
| CVE-2023-6835 | 2.2.0.0 – < 2.2.0.16 ; 2.5.0.0 – < 2.5.0.17 ; 2.6.0.0 – < 2.6.0.24 | Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could | MEDIUM 5.3 | 0.5 % |