Skip to content
CVE PROGRAM SOURCE RECORD5.6 Medium

CVE-2024-2321

Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are not required for API access, potentially enabling unauthorized operations. Exploitation requires an attacker to obtain a valid refresh token of an admin user. Since refresh tokens generally have a longer expiration time, this could lead to prolonged unauthorized access to API resources, impacting data confidentiality and integrity.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.0.0unknown
  • 4.0.0 to < 4.0.0.275affected
  • 4.1.0 to < 4.1.0.153affected
  • 4.2.0 to < 4.2.0.83affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.9.0unknown
  • 5.11.0 to < 5.11.0.326affected
  • 6.0.0 to < 6.0.0.172affected
  • 6.1.0 to < 6.1.0.130affected

References