Skip to contentWso2 Identity Server vulnerabilities
- wso2 api manager, identity server +1 moreReflected Cross-Site Scripting (XSS) in Authentication Endpoint of Multiple WSO2 Products Due to Missing Output EncodingCVE-2024-59626.1 Medium
- wso2 identity server, client attestation filter, carbon identity client attestation met data mgt be +2 moreImproper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native AuthenticationCVE-2024-74875.8 Medium
- wso2 identity serverReflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login FlowCVE-2024-71034.6 Medium
- wso2 api manager, identity server, identity server as key manager +6 more +8 moreIncorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account TakeoverCVE-2024-69149.8 Critical
- wso2 api manager, identity server +1 moreIncorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh TokenCVE-2024-23215.6 Medium
- wso2 api manager, api manager analytics, api microgateway +7 more +9 moreWSO2 Registry Stored Cross Site Scripting (XSS) vulnerabilityCVE-2023-6911Fix available4.8 Medium
- wso2 api manager, identity server, identity server as key manager +1 more +3 moreReflected XSS vulnerability can be exploited by tampering a request parameter in Authentication...CVE-2023-68386.1 Medium
- wso2 api manager, carbon identity application authentication endpoint, carbon identity application authentication framework +4 more +6 moreIncorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User ImpersonationCVE-2023-6837Fix available8.5 High
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 products vulnerable to XML External Entity attackCVE-2023-6836Fix available4.6 Medium
- wso2 api manager, identity server, identity server as key manager +2 moreXML External Entity (XXE) vulnerability in the file based service provider creation feature of...CVE-2021-426469.1 Critical
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreA reflected XSS issue exists in the Management Console of several WSO2 products. This affects API...CVE-2022-29548Public exploitEPSS 41.1%4.6 Medium
- wso2 api manager, enterprise integrator, identity server +6 more +8 moreCertain WSO2 products allow unrestricted file upload with resultant remote code execution. This...CVE-2022-29464In KEVPublic exploitEPSS 100.0%9.8 Critical
- wso2 identity server, api manager, identity server as key manager +1 more +3 moreIn accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to...CVE-2021-367606.1 Medium
- wso2 api manager, api manager analytics, api microgateway +5 more +7 moreWSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.CVE-2020-17453Public exploitEPSS 26.2%6.1 Medium
- wso2 api manager, api manager analytics, identity server +3 more +5 moreAn issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This...CVE-2020-247066.1 Medium
- wso2 api manager, api manager analytics, identity server +3 more +5 moreAn issue was discovered in certain WSO2 products. A valid Carbon Management Console session...CVE-2020-247058.8 High
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This...CVE-2020-247046.1 Medium
- wso2 api manager, api manager analytics, api microgateway +6 more +8 moreAn issue was discovered in certain WSO2 products. A valid Carbon Management Console session...CVE-2020-247038.8 High
- wso2 api manager, api manager analytics, api microgateway +2 more +4 moreThe Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates....CVE-2020-245916.5 Medium
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through...CVE-2020-144445.4 Medium
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through...CVE-2020-144454.4 Medium
- wso2 identity server, identity server as key manager +1 moreAn issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through...CVE-2020-144466.1 Medium
- wso2 api manager, api microgateway, identity server as key manager +2 moreIn WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5...CVE-2020-138835.5 Medium
- wso2 api manager, api manager analytics, api microgateway +4 more +6 moreXXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and...CVE-2020-127198.7 High
- wso2 api manager, identity server +1 moreAn issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2...CVE-2019-204376.1 Medium
- wso2 api manager, enterprise integrator, identity server +2 moreAn issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as...CVE-2019-204423.5 Low
- wso2 api manager, enterprise integrator, identity server +2 moreAn issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as...CVE-2019-204433.5 Low
- wso2 api manager, identity server +1 moreAn issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2...CVE-2019-204366.1 Medium
- wso2 identity serverWSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.CVE-2019-188816.1 Medium
- wso2 identity serverWSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is...CVE-2019-188826.1 Medium
- wso2 api manager, identity server, identity server as key manager +2 moreAn issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon...CVE-2018-207375.4 Medium
- wso2 identity serverWSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged...CVE-2018-8716Public exploitEPSS 38.1%5.4 Medium
- wso2 data analytics server, api manager, app manager +14 more +16 moreWSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via...CVE-2017-146514.8 Medium
- wso2 identity serverXML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0...CVE-2016-4312Public exploit7.5 High
- wso2 identity serverCross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server...CVE-2016-4311Public exploit8.8 High