Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2024-3511

Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.205affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.273affected
  • 3.2.0 to < 3.2.0.361affected
  • 3.2.1 to < 3.2.1.13affected
  • 4.0.0 to < 4.0.0.306affected
  • 4.1.0 to < 4.1.0.163affected
  • 4.2.0 to < 4.2.0.98affected
  • 4.3.0 to < 4.3.0.17affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.289affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.292affected
  • 5.11.0 to < 5.11.0.333affected
  • 6.0.0 to < 6.0.0.180affected
  • 6.1.0 to < 6.1.0.141affected
  • 7.0.0 to < 7.0.0.8affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.320affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.341affected

WSO2 WSO2 Carbon User Manager Kernel

Default version status: unknown

  • 4.5.0 to < 4.5.0.5affected
  • 4.5.3 to < 4.5.3.35affected
  • 4.6.0 to < 4.6.0.140affected
  • 4.6.1 to < 4.6.1.107affected
  • 4.6.2 to < 4.6.2.323affected
  • 4.6.3 to < 4.6.3.18affected
  • 4.6.4 to < 4.6.4.3affected
  • 4.7.1 to < 4.7.1.47affected
  • 4.8.1 to < 4.8.1.19affected
  • 4.9.0 to < 4.9.0.52affected
  • 4.9.26 to < 4.9.26.10affected
  • 4.10.9 to < 4.10.9.8affected
  • 4.10.13 to ≤ *unaffected

References