An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| wso2 | api_control_plane | - | - |
| wso2 | api_manager | - | - |
| wso2 | api_manager | - |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
22
Affected Products
1
References
wso2 / api_control_plane
| - |
| wso2 | api_manager | - | - |
| wso2 | api_manager | - | - |
| wso2 | api_manager | - | - |
| wso2 | api_manager | - | - |
| wso2 | api_manager | - | - |
| wso2 | api_manager | - | - |
| wso2 | api_manager | - | - |
| wso2 | enterprise_integrator | - | - |
| wso2 | identity_server | - | - |
| wso2 | identity_server | - | - |
| wso2 | identity_server | - | - |
| wso2 | identity_server | - | - |
| wso2 | identity_server | - | - |
| wso2 | identity_server | - | - |
| wso2 | identity_server_as_key_manager | - | - |
| wso2 | open_banking_am | - | - |
| wso2 | open_banking_iam | - | - |
| wso2 | traffic_manager | - | - |
| wso2 | universal_gateway | - | - |
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability
Impact