Veille CVE

Recherche « WSO2 Carbon User Management UI »

4 CVE

Critique 1 Élevée 0 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WSO2 Carbon User Management UI » ✕
  1. CVE-2024-5139 6.1 Moyenne

    WSO2 Enterprise Integrator · WSO2 Identity Server · WSO2 API Manager · WSO2 Open Banking AM

    The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

  2. CVE-2024-4412 2.7 Faible

    WSO2 Enterprise Integrator · WSO2 API Manager · WSO2 Open Banking IAM · WSO2 Identity Server

    The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

  3. CVE-2026-3418 9.1 Critique

    WSO2 API Manager · WSO2 Traffic Manager · WSO2 API Control Plane · WSO2 Universal Gateway

    The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

  4. CVE-2025-13394 5.4 Moyenne

    WSO2 Identity Server · WSO2 API Manager · WSO2 Open Banking IAM · WSO2 Open Banking AM

    The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.