Description (CNA)
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WSO2 / WSO2 Open Banking AM | unknown 0 before 2.0.0; affected 2.0.0 before 2.0.0.398 |
| WSO2 / WSO2 Open Banking IAM | unknown 0 before 2.0.0; affected 2.0.0 before 2.0.0.418 |
| WSO2 / WSO2 Traffic Manager | affected 4.5.0 before 4.5.0.34; affected 4.6.0 before 4.6.0.1 |
| WSO2 / WSO2 Universal Gateway | affected 4.5.0 before 4.5.0.34; affected 4.6.0 before 4.6.0.1 |
| WSO2 / WSO2 API Control Plane | affected 4.5.0 before 4.5.0.36; affected 4.6.0 before 4.6.0.1 |
| WSO2 / WSO2 API Manager | unknown 0 before 3.1.0; affected 3.1.0 before 3.1.0.349; affected 3.2.0 before 3.2.0.453; affected 3.2.1 before 3.2.1.73; affected 4.0.0 before 4.0.0.373; affected 4.1.0 before 4.1.0.236; affected 4.2.0 before 4.2.0.176; affected 4.3.0 before 4.3.0.88; affected 4.4.0 before 4.4.0.52; affected 4.5.0 before 4.5.0.35; affected 4.6.0 before 4.6.0.1 |
| WSO2 / WSO2 Identity Server as Key Manager | unknown 0 before 5.10.0; affected 5.10.0 before 5.10.0.369 |
| WSO2 / WSO2 Identity Server | unknown 0 before 5.10.0; affected 5.10.0 before 5.10.0.378; affected 5.11.0 before 5.11.0.425; affected 6.0.0 before 6.0.0.252; affected 6.1.0 before 6.1.0.253; affected 7.0.0 before 7.0.0.130; affected 7.1.0 before 7.1.0.38; affected 7.2.0 before 7.2.0.1 |
CWE
CWE-78
References
ADP enrichment
No English description supplied.
No references supplied.