WSO2 Open Banking IAM

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.

Potential Broken Access Control in Multiple WSO2 Products via System REST APIs

Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover

Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution

Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution

Potential cross-tenant account takeover vulnerability in Multiple WSO2 Products via Adaptive Authentication and Auto-Login

Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

Username Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled

Username Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account Discovery

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup

Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files

Authentication Bypass in Multiple WSO2 Products via Stale FIDO Credential Association

Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery