Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-3511

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.

Published

2025-06-23T09:15:21.580

Last Modified

2025-10-06T13:35:40.377

Status

Analyzed

Source

ed10eef1-636d-4fbe-9993-6890dfa878f8

Severity

CVSSv3.1: 4.3 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-863
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application wso2 api_manager 3.2.0 Yes
Application wso2 api_manager 3.2.1 Yes
Application wso2 api_manager 4.0.0 Yes
Application wso2 api_manager 4.1.0 Yes
Application wso2 api_manager 4.2.0 Yes
Application wso2 api_manager 4.3.0 Yes
Application wso2 enterprise_integrator 6.6.0 Yes
Application wso2 identity_server 5.10.0 Yes
Application wso2 identity_server 5.11.0 Yes
Application wso2 identity_server 6.0.0 Yes
Application wso2 identity_server 6.1.0 Yes
Application wso2 identity_server 7.0.0 Yes
Application wso2 identity_server_as_key_manager 5.10.0 Yes
Application wso2 open_banking_am 2.0.0 Yes
Application wso2 open_banking_iam 2.0.0 Yes
References