Description (CNA)
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WSO2 / WSO2 API Manager | unknown 0 before 4.0.0; affected 4.0.0 before 4.0.0.384; affected 4.1.0 before 4.1.0.248; affected 4.2.0 before 4.2.0.188; affected 4.3.0 before 4.3.0.99; affected 4.4.0 before 4.4.0.63; affected 4.5.0 before 4.5.0.48; affected 4.6.0 before 4.6.0.12 |
| WSO2 / WSO2 API Control Plane | affected 4.5.0 before 4.5.0.49; affected 4.6.0 before 4.6.0.13 |
| WSO2 / WSO2 Universal Gateway | affected 4.5.0 before 4.5.0.48; affected 4.6.0 before 4.6.0.12 |
| WSO2 / WSO2 Traffic Manager | affected 4.5.0 before 4.5.0.47; affected 4.6.0 before 4.6.0.12 |
| WSO2 / WSO2 Carbon API Manager Rest API Common Functions | affected 9.0.174 before 9.0.174.550; affected 9.28.116 before 9.28.116.404; affected 9.29.120 before 9.29.120.221; affected 9.30.67 before 9.30.67.146; affected 9.31.86 before 9.31.86.130; affected 9.32.147 before 9.32.147.26; unaffected 9.33.27 through * |
| WSO2 / WSO2 Carbon API Manager Rest API Utility | affected 9.20.74 before 9.20.74.392; unaffected 9.33.27 through * |
CWE
CWE-269
References
ADP enrichment
No English description supplied.
No references supplied.