Description (CNA)
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WSO2 / WSO2 API Manager | affected 4.1.0 before 4.1.0.242; affected 4.2.0 before 4.2.0.182; affected 4.3.0 before 4.3.0.93; affected 4.4.0 before 4.4.0.57; affected 4.5.0 before 4.5.0.41; affected 4.6.0 before 4.6.0.6 |
| WSO2 / WSO2 API Control Plane | affected 4.5.0 before 4.5.0.42; affected 4.6.0 before 4.6.0.7 |
| WSO2 / WSO2 Traffic Manager | affected 4.5.0 before 4.5.0.40; affected 4.6.0 before 4.6.0.6 |
| WSO2 / WSO2 Universal Gateway | affected 4.5.0 before 4.5.0.40; affected 4.6.0 before 4.6.0.6 |
| WSO2 / WSO2 Carbon API Management Implementation | affected 9.20.74 before 9.20.74.388; affected 9.28.116 before 9.28.116.395; affected 9.29.120 before 9.29.120.213; affected 9.30.67 before 9.30.67.135; affected 9.31.86 before 9.31.86.108; affected 9.32.147 before 9.32.147.5; unaffected 9.32.160 through * |
| WSO2 / WSO2 Carbon API Manager Rest API Utility | affected 9.20.74 before 9.20.74.388; affected 9.28.116 before 9.28.116.395; affected 9.29.120 before 9.29.120.213; affected 9.30.67 before 9.30.67.135; affected 9.31.86 before 9.31.86.108; affected 9.32.147 before 9.32.147.5; unaffected 9.32.160 through * |
CWE
CWE-284
References
ADP enrichment
No English description supplied.
No references supplied.