CVE-2022-29464

CVE-2022-29464 WSO2 は、SOA 関連のインフラストラクチャ、技術フレームワーク、関連ツール、プロセスサーバー、アプリケーションサーバーなどを含む、さまざまな SOA ソリューションを提供するリーディングカンパニーです。 影響範囲 2.2.0 ≤ WSO2 API Manager ≤ 4.0.0 5.2.0 ≤ WSO2 Identity Server ≤ 5.11.0 WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0 5.3.0 ≤ WSO2 Identity Server as Key Manager...

carbon-identity-framework

carbon-identity-framework ブランチ| ビルドステータス ---|--- master| このリポジトリには、WSO2 Identity Server 製品に必要なコアコンポーネントと機能が含まれています。 ソースからのビルド ソースコードから carbon-identity-framework をビルドする場合: 1. Java 21 をインストールします。 2. Apache Maven 3.x.x をインストールします https://maven.apache.org/download.cgi 3. このリポジトリ...

WSO2 - Cross-Site Scripting

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

CVE-2024-8122

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

EUVD-2024-55782

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

CVE-2024-8122 Potential brute force vulnerability due to non-expiring SMS OTPs

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

CVE-2024-8122

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA). Because unused OTPs remain valid indefinitely, malicious actors can conduct brute force attacks by repeatedly guessing the code over an unlimited timeframe....

PT-2026-107723

The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords OTPs used in multi-factor authentication MFA. This allows unused OTPs to remain valid indefinitely, presenting an opportunity for malicious actors to conduct brute force attacks by repeatedly guessing the...

WSO2RCE

WSO2RCE CVE-2022-29464는 WSO2 API Manager 및 WSO2 Open Banking 과 같은 일부 WSO2 제품에 영향을 미치며, 임의 파일 업로드 및 원격 코드 실행을 허용합니다. 영향을 받는 제품: WSO2 API Manager 2.2.0 4.0.0 WSO2 Identity Server 5.2.0 5.11.0 WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0, 5.6.0 WSO2 Identity Server as Key Manager 5.3.0 5.11.0...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464는 오픈소스 ID 및 접근 관리 플랫폼인 WSO2 Identity Server의 심각한 취약점입니다. 이 취약점을 통해 원격 공격자는 관리자 권한으로 대상 시스템에서 임의의 명령을 실행할 수 있는 악성 JSP 파일을 업로드할 수 있습니다. 파일 확장자 검증 메커니즘을 우회하여 악용되는 파일 업로드 기능 문제입니다. 이 취약점은 심각도를 나타내는 CVSS 점수 9.8을 할당받았습니다. 예시 Dorks title:"WSO2 Carbon Server" 스크린샷 요구 사항...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CVE-2025-13166 Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an attacker to discover valid usernames within the system. The...

CLEANSTART-2026-QG86215 Security fixes in wso2is 7.1.0-r0

Package wso2is version 7.1.0-r0 fixes 17 vulnerabilities: CVE-2025-8671, CVE-2025-23184, CVE-2025-48734, CVE-2025-48795, CVE-2025-48924...

CVE-2025-12627

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-13909 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2025-12627

WSO2 Identity Server is affected by CVE-2025-12627 due to improper refresh token handling in the user impersonation flow. If an attacker has an impersonated access token, they can use the refresh_token grant to obtain new access tokens, extending their ability to act as the impersonated user. Thi...

EUVD-2025-210629

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-12627 Improper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized Actions

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...

CVE-2025-14779 Improper Access Control via Secret Type Management API in WSO2 Identity Server

The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation o...

CVE-2025-12627: Insufficient Session Expiration

The user impersonation flow in WSO2 Identity Server fails to properly manage refresh tokens associated with impersonated sessions. This allows an attacker who has obtained an access token for an impersonated user to leverage the refresh token grant to obtain new access tokens, extending their...