WSO2 API Manager improper authorization

Summaryinfo

A vulnerability labeled as critical has been found in WSO2 API Manager, Traffic Manager, API Control Plane, Universal Gateway, Open Banking AM, Identity Server, Open Banking IAM, Identity Server as Key Manager and Carbon OAuth. This issue affects some unknown processing. Such manipulation leads to improper authorization. This vulnerability is uniquely identified as CVE-2024-8995. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in WSO2 API Manager, Traffic Manager, API Control Plane, Universal Gateway, Open Banking AM, Identity Server, Open Banking IAM, Identity Server as Key Manager and Carbon OAuth. It has been rated as critical. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code.

The advisory is available at security.docs.wso2.com. This vulnerability is handled as CVE-2024-8995 since 09/19/2024. The exploitation is known to be easy. The attack may be launched remotely. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/06/2026). This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Banking Software

Vendor

• WSO2

Name

• API Control Plane
• API Manager
• Carbon OAuth
• Identity Server
• Identity Server as Key Manager
• Open Banking AM
• Open Banking IAM
• Traffic Manager
• Universal Gateway

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion