CVE Vulnerability Advisory Database

[Affected Scope] Users with the Publisher role in WSO2 API Manager

[Impact] Execution of malicious scripts leading to browser redirection, UI defacement, and information disclosure (mitigated by httpOnly flags on sensitive session cookies)

[Mitigation] Apply official WSO2 security patches and enforce strict Content-Security-Policy (CSP) headers for uploaded media.

[Affected Scope] WSO2 components, including WSO2 Identity Server and API Manager, that accept user-supplied input for constructing redirection URLs

[Impact] Attackers can redirect users to arbitrary external domains, facilitating highly convincing phishing and social engineering attacks to harvest sensitive credentials

[Mitigation] Apply the latest security patches via WSO2 Update Utility as detailed in advisory WSO2-2024-3254, and enforce strict redirection whitelist validation

[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.

[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.

[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.

[Affected Scope] WSO2 API Manager (2.2.0 to 4.0.0), Identity Server (5.2.0 to 5.11.0), Enterprise Integrator (6.2.0 to 6.6.0), and other major WSO2 products

[Impact] Unauthenticated attackers can upload and execute arbitrary JSP files via a crafted HTTP request, leading to complete system compromise

[Mitigation] Apply official WSO2 security patches immediately, restrict external access to the '/fileupload' endpoint, and disable execution permissions in web root subdirectories