جزئیات آسیبپذیری
CVE-2025-10611
WSO2 API Control PlaneWSO2 API ManagerWSO2 Identity ServerWSO2 Identity Server as Key ManagerWSO2 Open Banking AMWSO2 Open Banking IAM
Potential Broken Access Control in Multiple WSO2 Products via System REST APIs
CVSS 3.1
9.8بحرانی
شرح رسمی (انگلیسی)
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.8بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0 ≤ v < 4.5.0.29 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | v < 2.1.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 2.1.0 ≤ v < 2.1.0.42 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 2.2.0 ≤ v < 2.2.0.61 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 2.5.0 ≤ v < 2.5.0.87 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 2.6.0 ≤ v < 2.6.0.148 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.0.0 ≤ v < 3.0.0.178 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.345 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.446 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.66 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.366 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.228 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.169 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.81 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.45 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.5.0 ≤ v < 4.5.0.28 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | v < 5.3.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.375 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.419 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.3.0 ≤ v < 5.3.0.39 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.5.0 ≤ v < 5.5.0.54 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.6.0 ≤ v < 5.6.0.62 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.7.0 ≤ v < 5.7.0.128 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.8.0 ≤ v < 5.8.0.112 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.9.0 ≤ v < 5.9.0.171 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.248 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.248 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.124 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.1.0 ≤ v < 7.1.0.31 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.3.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.365 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.3.0 ≤ v < 5.3.0.44 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.5.0 ≤ v < 5.5.0.55 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.6.0 ≤ v < 5.6.0.77 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.7.0 ≤ v < 5.7.0.127 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.9.0 ≤ v < 5.9.0.178 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | v < 1.4.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 1.4.0 ≤ v < 1.4.0.141 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 1.5.0 ≤ v < 1.5.0.142 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.394 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.414 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking KM | v < 1.4.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking KM | 1.4.0 ≤ v < 1.4.0.135 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking KM | 1.5.0 ≤ v < 1.5.0.125 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | 4.5.0 ≤ v < 4.5.0.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | 4.5.0 ≤ v < 4.5.0.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.1.1 ≤ v < 1.1.1.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.1.16 ≤ v < 1.1.16.6 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.1.18 ≤ v < 1.1.18.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.1.20 ≤ v < 1.1.20.9 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.1.26 ≤ v < 1.1.26.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.3.6 ≤ v < 1.3.6.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.4.0 ≤ v < 1.4.0.21 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.4.25 ≤ v < 1.4.25.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.4.52 ≤ v < 1.4.52.6 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.6.1 ≤ v < 1.6.1.12 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.7.1 ≤ v < 1.7.1.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.8 ≤ v < 1.8.48 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.8.11 ≤ v < 1.8.11.8 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.8.41 ≤ v < 1.8.41.4 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.9.18 ≤ v < 1.9.18.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service | 1.9.4 ≤ v < 1.9.4.9 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.1.1 ≤ v < 1.1.1.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.1.16 ≤ v < 1.1.16.6 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.1.18 ≤ v < 1.1.18.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.1.20 ≤ v < 1.1.20.9 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.1.26 ≤ v < 1.1.26.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.3.6 ≤ v < 1.3.6.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.4.0 ≤ v < 1.4.0.21 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.4.25 ≤ v < 1.4.25.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.4.52 ≤ v < 1.4.52.6 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.6.1 ≤ v < 1.6.1.12 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.7.1 ≤ v < 1.7.1.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.8 ≤ v < 1.8.48 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.8.11 ≤ v < 1.8.11.8 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.8.41 ≤ v < 1.8.41.4 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.9.18 ≤ v < 1.9.18.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve | 1.9.4 ≤ v < 1.9.4.9 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
کانال تلگرام کُلون @kolunsec_fa
تازههای KEV، خبرهای مهم و خلاصهی روزانه
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۰۷/۲۴
- آخرین بهروزرسانی
- ۱۴۰۴/۰۷/۲۴
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- WSO2
پیشبینی بهرهبرداری (EPSS)
۰٫۸۲٪
احتمال بهرهبرداری در ۳۰ روز
۵۷٫۵٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهرهبرداری
- ندارد
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-863Incorrect Authorization