| Package | Affected versions | Patched versions |
|---|---|---|
| api control plane | = 4.5.0 | |
| api manager | = 3.0.0= 3.1.0= 3.2.0= 3.2.1= 4.0.0= 4.1.0= 4.2.0= 4.3.0= 4.4.0= 4.5.0 | |
| open banking am | = 2.0.0 | |
| traffic manager | = 4.5.0 |
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free