Description
The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- wso2 / api_control_plane4.5.0 – 4.5.0
- wso2 / api_manager4.3.0 – 4.3.0
- wso2 / api_manager4.2.0 – 4.2.0
- wso2 / api_manager4.1.0 – 4.1.0
- wso2 / api_manager4.0.0 – 4.0.0
- wso2 / api_manager3.2.1 – 3.2.1
- wso2 / api_manager3.2.0 – 3.2.0
- wso2 / api_manager3.1.0 – 3.1.0
- wso2 / api_manager4.5.0 – 4.5.0
- wso2 / identity_server5.10.0 – 5.10.0
- wso2 / identity_server5.11.0 – 5.11.0
- wso2 / identity_server_as_key_manager5.10.0 – 5.10.0
- wso2 / open_banking_iam2.0.0 – 2.0.0
- wso2 / traffic_manager4.5.0 – 4.5.0
- wso2 / universal_gateway4.5.0 – 4.5.0
- wso2 / WSO2 API Control Plane4.5.0 – 4.5.0.10
- wso2 / WSO2 API Manager4.3.0 – 4.3.0.51
- wso2 / WSO2 API Manager0 – 3.1.0
- wso2 / WSO2 API Manager3.1.0 – 3.1.0.331
- wso2 / WSO2 API Manager3.2.0 – 3.2.0.427
- wso2 / WSO2 API Manager3.2.1 – 3.2.1.39
- wso2 / WSO2 API Manager4.0.0 – 4.0.0.318
- wso2 / WSO2 API Manager4.1.0 – 4.1.0.200
- wso2 / WSO2 API Manager4.2.0 – 4.2.0.138
- wso2 / WSO2 API Manager4.5.0 – 4.5.0.9
- wso2 / WSO2 Carbon Identity Recovery Management1.8.108 – 1.8.108.4
- wso2 / WSO2 Carbon Identity Recovery Management1.6.380 – 1.6.*
- wso2 / WSO2 Carbon Identity Recovery Management1.8.109 – *
- wso2 / WSO2 Carbon Identity Recovery Management1.8.107 – 1.8.107.2
- wso2 / WSO2 Carbon Identity Recovery Management1.7.2 – 1.7.2.4
- wso2 / WSO2 Carbon Identity Recovery Management1.4.102 – 1.4.102.2
- wso2 / WSO2 Carbon Identity Recovery Management1.4.100 – 1.4.100.8
- wso2 / WSO2 Carbon Identity Recovery Management1.4.72 – 1.4.72.68
- wso2 / WSO2 Carbon Identity Recovery Management1.4.1 – 1.4.1.72
- wso2 / WSO2 Identity Server5.11.0 – 5.11.0.379
- wso2 / WSO2 Identity Server5.10.0 – 5.10.0.358
- wso2 / WSO2 Identity Server0 – 5.10.0
- wso2 / WSO2 Identity Server as Key Manager5.10.0 – 5.10.0.351
- wso2 / WSO2 Identity Server as Key Manager0 – 5.10.0
- wso2 / WSO2 Open Banking IAM2.0.0 – 2.0.0.400
- wso2 / WSO2 Open Banking IAM0 – 2.0.0
- wso2 / WSO2 Traffic Manager4.5.0 – 4.5.0.9
- wso2 / WSO2 Universal Gateway4.5.0 – 4.5.0.9
Updated 16m ago · 8 sources