DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
WSO2 API Manager: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um seine Privilegien zu erhöhen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-13173US | — | — | ||
Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initiated. This occurs when the session-bound… | ||||
| CVE-2026-3418US | — | — | ||
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-acc… | ||||
| CVE-2026-3415US | — | — | ||
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the… | ||||
| CVE-2026-5430US | —OT kritisch | KEV | ||
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupport… | ||||
| CVE-2026-1728US | — | — | ||
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs.
Exploitation of this vulnerability allows… | ||||
| CVE-2026-0637US | — | — | ||
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sa… | ||||
| CVE-2025-13394US | — | — | ||
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTT… | ||||
| CVE-2026-2445US | — | — | ||
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition… | ||||
| CVE-2026-4249US | — | — | ||
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an u… | ||||
| CVE-2026-2053US | critical10.0 | — | ||
The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This om… | ||||
| CVE-2025-5717US | high7.2 | — | ||
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with admin… | ||||
| CVE-2026-2613US | — | — | ||
| CVE-2026-4052US | — | — | ||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
- WSO2 Security Advisory vom 2026-06-25external
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan