Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes.
Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WSO2 API Control Plane
Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.5.0
affected
custom
4.5.0.10
Unavailable
None listed
WSO2 Traffic Manager
Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.5.0
affected
custom
4.5.0.9
Unavailable
None listed
WSO2 Universal Gateway
Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.5.0
affected
custom
4.5.0.9
Unavailable
None listed
WSO2 API Manager
Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
3.1.0
Unavailable
None listed
3.1.0
affected
custom
3.1.0.331
Unavailable
None listed
3.2.0
affected
custom
3.2.0.427
Unavailable
None listed
3.2.1
affected
custom
3.2.1.39
Unavailable
None listed
4.0.0
affected
custom
4.0.0.318
Unavailable
None listed
4.1.0
affected
custom
4.1.0.200
Unavailable
None listed
4.2.0
affected
custom
4.2.0.138
Unavailable
None listed
4.3.0
affected
custom
4.3.0.51
Unavailable
None listed
4.5.0
affected
custom
4.5.0.9
Unavailable
None listed
WSO2 Open Banking IAM
Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
2.0.0
Unavailable
None listed
2.0.0
affected
custom
2.0.0.400
Unavailable
None listed
WSO2 Identity Server as Key Manager
Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
5.10.0
Unavailable
None listed
5.10.0
affected
custom
5.10.0.351
Unavailable
None listed
WSO2 Identity Server
Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts