Description
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
Affected products
- WSO2 / WSO2 API Control Plane4.5.0 – 4.5.0.42
- WSO2 / WSO2 API Control Plane4.6.0 – 4.6.0.7
- WSO2 / WSO2 API Manager4.3.0 – 4.3.0.93
- WSO2 / WSO2 API Manager4.4.0 – 4.4.0.57
- WSO2 / WSO2 API Manager4.1.0 – 4.1.0.242
- WSO2 / WSO2 API Manager4.6.0 – 4.6.0.6
- WSO2 / WSO2 API Manager4.5.0 – 4.5.0.41
- WSO2 / WSO2 API Manager4.2.0 – 4.2.0.182
- WSO2 / WSO2 Carbon API Management Implementation9.28.116 – 9.28.116.395
- WSO2 / WSO2 Carbon API Management Implementation9.20.74 – 9.20.74.388
- WSO2 / WSO2 Carbon API Management Implementation9.29.120 – 9.29.120.213
- WSO2 / WSO2 Carbon API Management Implementation9.30.67 – 9.30.67.135
- WSO2 / WSO2 Carbon API Management Implementation9.31.86 – 9.31.86.108
- WSO2 / WSO2 Carbon API Management Implementation9.32.147 – 9.32.147.5
- WSO2 / WSO2 Carbon API Management Implementation9.32.160 – *
- WSO2 / WSO2 Carbon API Manager Rest API Utility9.30.67 – 9.30.67.135
- WSO2 / WSO2 Carbon API Manager Rest API Utility9.31.86 – 9.31.86.108
- WSO2 / WSO2 Carbon API Manager Rest API Utility9.32.147 – 9.32.147.5
- WSO2 / WSO2 Carbon API Manager Rest API Utility9.32.160 – *
- WSO2 / WSO2 Carbon API Manager Rest API Utility9.20.74 – 9.20.74.388
- WSO2 / WSO2 Carbon API Manager Rest API Utility9.28.116 – 9.28.116.395
- WSO2 / WSO2 Carbon API Manager Rest API Utility9.29.120 – 9.29.120.213
- WSO2 / WSO2 Traffic Manager4.5.0 – 4.5.0.40
- WSO2 / WSO2 Traffic Manager4.6.0 – 4.6.0.6
- WSO2 / WSO2 Universal Gateway4.6.0 – 4.6.0.6
- WSO2 / WSO2 Universal Gateway4.5.0 – 4.5.0.40
Updated 16m ago · 8 sources