WSO2 WSO2 Carbon API Management Implementation
5 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-3418 | 9.30.67 – < 9.30.67.156 ; 9.31.86 – < 9.31.86.141 ; 9.32.147 – < 9.32.147.44 | Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution | CRITICAL 9.1 | 0.8 % | ||
| CVE-2026-3415 | | XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2025-14561 | 9.20.74 – < 9.20.74.388 ; 9.28.116 – < 9.28.116.395 ; 9.29.120 – < 9.29.120.213 ; … | Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations | CRITICAL 9.0 | 0.4 % | ||
| CVE-2025-8325 | 6.7.206 – < 6.7.206.563 ; 6.7.210 – < 6.7.210.55 ; 9.0.174 – < 9.0.174.513 ; … | Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations | HIGH 8.8 | 0.2 % | ||
| CVE-2025-8154 | | HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation | HIGH 7.5 | 0.2 % |