identity server · threatengine.sh

Home/Product/wso2 identity server

Product

wso2 identity server

66 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

>= 7.1.0 and < 7.1.0.28

The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of pr

Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enf

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection

>= 5.10.0 and < 5.10.0.300

The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution

>= 6.0.0 and < 6.0.0.171

When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a loc

Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOA

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper ou

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lac

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and des

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The a

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access t

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain in

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certai

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in t

A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account i

A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improp

A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Auth

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files store

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error

A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin

A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient i

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authe

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows us

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malic

A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoint of multiple WSO2 products due to missin

An improper authentication vulnerability exists in WSO2 Identity Server 7.0.0 due to an implementation flaw that allows app-native

A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due t

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-rel

An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) att

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in

>= 5.6.0 and < 5.6.0.16

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but

XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0

>= 5.2.0 and <= 5.11.0

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload end

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affe

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, AP

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-cont

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manage

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-cont

An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cros

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cros

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom cla

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a cla

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identi

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identi

WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.

WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.

IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs Lo

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.

>= 1.0.0 and <= 1.5.2

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization respons

WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might

XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-023

Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin