cveboard RSS feed

CVE-2024-8995

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2024
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused. If an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.1.0UnavailableNone listed
3.1.0affectedcustom3.1.0.320UnavailableNone listed
3.2.0affectedcustom3.2.0.413UnavailableNone listed
3.2.1affectedcustom3.2.1.90UnavailableNone listed
4.0.0affectedcustom4.0.0.334UnavailableNone listed
4.1.0affectedcustom4.1.0.255UnavailableNone listed
4.2.0affectedcustom4.2.0.195UnavailableNone listed
4.3.0affectedcustom4.3.0.106UnavailableNone listed
4.4.0affectedcustom4.4.0.70UnavailableNone listed
4.5.0affectedcustom4.5.0.55UnavailableNone listed
4.6.0affectedcustom4.6.0.19UnavailableNone listed

WSO2 Traffic Manager

Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.54UnavailableNone listed
4.6.0affectedcustom4.6.0.19UnavailableNone listed

WSO2 API Control Plane

Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.56UnavailableNone listed
4.6.0affectedcustom4.6.0.20UnavailableNone listed

WSO2 Universal Gateway

Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.55UnavailableNone listed
4.6.0affectedcustom4.6.0.19UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.369UnavailableNone listed

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.345UnavailableNone listed
5.11.0affectedcustom5.11.0.395UnavailableNone listed
6.0.0affectedcustom6.0.0.229UnavailableNone listed
6.1.0affectedcustom6.1.0.208UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.389UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.338UnavailableNone listed

WSO2 Carbon OAuth

Vendor
WSO2
Product
WSO2 Carbon OAuth
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth
WSO2 Carbon OAuth · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.4.2affectedcustom6.4.2.154UnavailableNone listed
6.4.111affectedcustom6.4.111.131UnavailableNone listed
6.4.176affectedcustom6.4.176.35UnavailableNone listed
6.4.180affectedcustom6.4.180.17UnavailableNone listed
6.8.0affectedcustom6.8.0.46UnavailableNone listed
6.9.6affectedcustom6.9.6.34UnavailableNone listed
6.11.21affectedcustom6.11.21.59UnavailableNone listed
6.13.16affectedcustom6.13.16.27UnavailableNone listed
6.13.19affectedcustom6.13.19.19UnavailableNone listed
6.13.27affectedcustom6.13.27.15UnavailableNone listed
6.13.41affectedcustom6.13.41.4UnavailableNone listed
6.11.53unaffectedcustomUnavailable*None listed