| Package | Affected versions | Patched versions |
|---|---|---|
| api control plane | ≥ 4.5.0, < 4.5.0.49≥ 4.6.0, < 4.6.0.13 | 4.5.0.494.6.0.13 |
| api manager | ≥ 4.0.0, < 4.0.0.384≥ 4.1.0, < 4.1.0.248≥ 4.2.0, < 4.2.0.188≥ 4.3.0, < 4.3.0.99≥ 4.4.0, < 4.4.0.63≥ 4.5.0, < 4.5.0.48≥ 4.6.0, < 4.6.0.12 | 4.0.0.3844.1.0.2484.2.0.1884.3.0.994.4.0.634.5.0.484.6.0.12 |
| traffic manager | ≥ 4.5.0, < 4.5.0.47≥ 4.6.0, < 4.6.0.12 | 4.5.0.474.6.0.12 |
| universal gateway | ≥ 4.5.0, < 4.5.0.48≥ 4.6.0, < 4.6.0.12 | 4.5.0.484.6.0.12 |
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative account takeover. This requires the attacker to already possess a low-privileged user account and be able to obtain a valid token for it.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free