Vulnerabilidades en WSO2

95 resultados
Análisis Vexday

Com 63 CVEs catalogadas e nenhuma atualmente listada no catálogo KEV da CISA, o WSO2 apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica menor pressão imediata de ameaças confirmadas em campo. No entanto, 7 vulnerabilidades de severidade crítica e 13 surgidas nos últimos 90 dias sinalizam um ritmo de descoberta que exige monitoramento contínuo. A falha mais comum é CWE-79 (Cross-site Scripting), padrão que, embora frequentemente subestimado, pode viabilizar ataques de sequestro de sessão e roubo de credenciais em plataformas de integração como as oferecidas pelo vendor. A CVE mais perigosa ativa no momento, CVE-2024-7074, registra escore EPSS de 0,0976 — probabilidade ainda moderada de exploração iminente, mas suficiente para recomendar priorização no ciclo de patching das equipes responsáveis por ambientes WSO2.

CVE-2024-0391MEDIUMUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2025-10853MEDIUMReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingEPSS 0.2%CVE-2026-4103MEDIUMCross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script ExecutionEPSS 0.2%CVE-2025-11850MEDIUMImproper Implicit Association via User Store Initialization in WSO2 Identity Server [Identity Confusion / External IDP Use]EPSS 0.2%CVE-2025-12624MEDIUMImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockEPSS 0.2%CVE-2024-10302MEDIUMImproper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data ExposureEPSS 0.2%CVE-2025-8325MEDIUMImproper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized OperationsEPSS 0.2%CVE-2025-10503MEDIUMReflected Cross-Site Scripting via Authentication Endpoint in WSO2 Identity ServerEPSS 0.2%CVE-2025-13736LOWUsername Enumeration via Login Interface in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2024-0392MEDIUMCross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token ValidationEPSS 0.1%CVE-2026-19515HIGHOS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command ExecutionEPSS 0.1%CVE-2025-12627LOWImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsEPSS 0.1%CVE-2024-8995MEDIUMAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessEPSS 0.1%CVE-2026-0637MEDIUMSensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 ProductsEPSS 0.1%CVE-2025-13394MEDIUMCross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized ActionsEPSS 0.1%