DeutschShown in its original language — a full translation is planned for a future version.
WSO2 API Manager: Mehrere Schwachstellen
view advisory published 2026-06-25
Ein Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um seine Privilegien zu erhöhen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-13173US | — | — | ||
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound… | ||||
| CVE-2026-3418US | — | — | ||
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-acc… | ||||
| CVE-2026-3415US | — | — | ||
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the… | ||||
| CVE-2026-5430US | —OT critical | KEV | ||
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupport… | ||||
| CVE-2026-1728US | — | — | ||
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.
Exploitation of this vulnerability allows… | ||||
| CVE-2026-0637US | — | — | ||
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sa… | ||||
| CVE-2025-13394US | — | — | ||
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTT… | ||||
| CVE-2026-2445US | — | — | ||
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition… | ||||
| CVE-2026-4249US | — | — | ||
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an u… | ||||
| CVE-2026-2053US | critical10.0 | — | ||
The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This om… | ||||
| CVE-2025-5717US | high7.2 | — | ||
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with admin… | ||||
| CVE-2026-2613US | — | — | ||
| CVE-2026-4052US | — | — | ||
02
references
External citations — patches, advisories, analysis.
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan