Vulnerabilidades em WSO2

131 resultados
Análise Vexday

Com 63 CVEs catalogadas e nenhuma atualmente listada no catálogo KEV da CISA, o WSO2 apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que indica menor pressão imediata de ameaças confirmadas em campo. No entanto, 7 vulnerabilidades de severidade crítica e 13 surgidas nos últimos 90 dias sinalizam um ritmo de descoberta que exige monitoramento contínuo. A falha mais comum é CWE-79 (Cross-site Scripting), padrão que, embora frequentemente subestimado, pode viabilizar ataques de sequestro de sessão e roubo de credenciais em plataformas de integração como as oferecidas pelo vendor. A CVE mais perigosa ativa no momento, CVE-2024-7074, registra escore EPSS de 0,0976 — probabilidade ainda moderada de exploração iminente, mas suficiente para recomendar priorização no ciclo de patching das equipes responsáveis por ambientes WSO2.

CVE-2024-3509MEDIUMStored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text EditorEPSS 0.2%CVE-2025-12627LOWImproper Refresh Token Implementation via User Impersonation Flow in WSO2 Identity Server Enables Continued Unauthorized ActionsEPSS 0.2%CVE-2024-12141MEDIUMOpen Redirect via Callback URL Validation in WSO2 Products Allows Phishing AttacksEPSS 0.2%CVE-2025-12544MEDIUMStored Cross-Site Scripting in Multiple WSO2 ProductsEPSS 0.2%CVE-2024-2372MEDIUMOpen Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing AttacksEPSS 0.2%CVE-2024-4867MEDIUMCross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information RetrievalEPSS 0.2%CVE-2026-0637MEDIUMHeader Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log ForgeryEPSS 0.2%CVE-2025-10853MEDIUMReflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output EncodingEPSS 0.2%CVE-2025-13173MEDIUMImproper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Unauthorized Access After Session TerminationEPSS 0.2%CVE-2024-5563MEDIUMIncomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force AttacksEPSS 0.2%CVE-2024-8995MEDIUMAuthorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized AccessEPSS 0.2%CVE-2025-4760MEDIUMAuthenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in PublisherEPSS 0.2%CVE-2024-7075MEDIUMReflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 ProductsEPSS 0.2%CVE-2025-8154MEDIUMHTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header ManipulationEPSS 0.2%CVE-2024-0391MEDIUMUsername Enumeration via Email OTP Flow in Multiple WSO2 Products Allows User Account DiscoveryEPSS 0.2%CVE-2025-7043MEDIUMRefresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource ConsumptionEPSS 0.2%CVE-2025-13647MEDIUMInformation Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File PathsEPSS 0.2%CVE-2024-9517MEDIUMImproper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked AccountsEPSS 0.2%CVE-2025-10149HIGHArbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account TakeoverEPSS 0.2%CVE-2025-12624MEDIUMImproper Token Invalidation in WSO2 Identity Server Allows Access After Account LockEPSS 0.2%