wso2 open banking am
productUScpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*
A product tracked in the threat graph; the vulnerabilities below are known to affect it.
by severity
3critical3high6medium0low
updated 2026-10-30
01
vulnerabilities (26)
Related CVEs.
| ID | severity | exploitable | ||||
|---|---|---|---|---|---|---|
| CVE-2022-29464US | critical9.8OT critical | KEV | ||||
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory travers… | ||||||
| CVE-2025-5605US | medium5.3 | — | ||||
An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to by… | ||||||
| CVE-2025-10611US | —OT elevated | — | ||||
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be i… | ||||||
| CVE-2024-6914US | —OT elevated | — | ||||
An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service. A malicious actor can exp… | ||||||
| CVE-2024-7096US | medium5.4OT elevated | — | ||||
A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated per… | ||||||
| CVE-2025-5717US | high7.2 | — | ||||
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with admin… | ||||||
| CVE-2025-15039US | — | — | ||||
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern in… | ||||||
| CVE-2024-7097US | —OT elevated | — | ||||
An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the self-registr… | ||||||
| CVE-2025-5350US | medium4.8 | — | ||||
SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepte… | ||||||
| CVE-2025-10907US | high7.2 | — | ||||
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor… | ||||||
| CVE-2025-9804US | medium6.5 | — | ||||
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A… | ||||||
| CVE-2024-8008US | — | — | ||||
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connect… | ||||||
| CVE-2025-10713US | critical9.1 | — | ||||
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applyi… | ||||||
| CVE-2024-6832US | high7.5 | — | ||||
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach… | ||||||
| CVE-2024-2374US | critical9.1 | — | ||||
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malici… | ||||||
| CVE-2025-12737US | — | — | ||||
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privile… | ||||||
| CVE-2024-1248US | medium5.3 | — | ||||
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user… | ||||||
| CVE-2025-13736US | — | — | ||||
When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canoni… | ||||||
| CVE-2025-8591US | — | — | ||||
The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to… | ||||||
| CVE-2025-9312US | —OT elevated | — | ||||
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to impro… | ||||||
| CVE-2025-6670US | — | — | ||||
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specif… | ||||||
| CVE-2024-3511US | —OT elevated | — | ||||
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization log… | ||||||
| CVE-2025-10853US | medium6.1 | — | ||||
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific paramete… | ||||||
| CVE-2024-8995US | — | — | ||||
Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to b… | ||||||
| CVE-2026-0637US | — | — | ||||
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sa… | ||||||
| CVE-2025-13394US | — | — | ||||
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTT… | ||||||
02
weaknesses (8)
The flaw types (CWEs) most of these CVEs share.
- CWE-863Incorrect Authorization5 CVEs
- CWE-79Improper Neutralization of Input During Web Page Generation4 CVEs
- CWE-352Cross-Site Request Forgery2 CVEs
- CWE-434Unrestricted Upload of File with Dangerous Type2 CVEs
- CWE-611Improper Restriction of XML External Entity Reference2 CVEs
- CWE-693Protection Mechanism Failure2 CVEs
- CWE-203Observable Discrepancy1 CVEs
- CWE-22Improper Limitation of a Pathname to a Restricted Directory1 CVEs
03
sources (1)
Which sources assert this record, and when.
- USNVD / CVE26 CVEs
scry
Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.
Free scan