| Package | Affected versions | Patched versions |
|---|---|---|
| api control plane | = 4.6.0≥ 4.5.0, < 4.5.0.36 | 4.5.0.36 |
| api manager | = 4.6.0≥ 3.1.0, < 3.1.0.349≥ 3.2.0, < 3.2.0.453≥ 3.2.1, < 3.2.1.73≥ 4.0.0, < 4.0.0.373≥ 4.1.0, < 4.1.0.236≥ 4.2.0, < 4.2.0.176≥ 4.3.0, < 4.3.0.88≥ 4.4.0, < 4.4.0.52≥ 4.5.0, < 4.5.0.35 | 3.1.0.3493.2.0.4533.2.1.734.0.0.3734.1.0.2364.2.0.1764.3.0.884.4.0.524.5.0.35 |
| identity server | = 7.2.0≥ 5.10.0, < 5.10.0.378≥ 5.11.0, < 5.11.0.425≥ 6.0.0, < 6.0.0.252≥ 6.1.0, < 6.1.0.253≥ 7.0.0, < 7.0.0.130≥ 7.1.0, < 7.1.0.38 | 5.10.0.3785.11.0.4256.0.0.2526.1.0.2537.0.0.1307.1.0.38 |
| identity server as key manager | ≥ 5.10.0, < 5.10.0.369 | 5.10.0.369 |
| open banking am | ≥ 2.0.0, < 2.0.0.398 | 2.0.0.398 |
| open banking iam | ≥ 2.0.0, < 2.0.0.418 | 2.0.0.418 |
| traffic manager | = 4.6.0≥ 4.5.0, < 4.5.0.34 | 4.5.0.34 |
| universal gateway | = 4.6.0≥ 4.5.0, < 4.5.0.34 | 4.5.0.34 |
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free