Access Control Bypass via Publisher REST APIs in Multiple WSO2 Products Allows Cross-Tenant Operations
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.
The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WSO2 API Manager
Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.1.0
affected
custom
4.1.0.242
Unavailable
None listed
4.2.0
affected
custom
4.2.0.182
Unavailable
None listed
4.3.0
affected
custom
4.3.0.93
Unavailable
None listed
4.4.0
affected
custom
4.4.0.57
Unavailable
None listed
4.5.0
affected
custom
4.5.0.41
Unavailable
None listed
4.6.0
affected
custom
4.6.0.6
Unavailable
None listed
WSO2 API Control Plane
Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.5.0
affected
custom
4.5.0.42
Unavailable
None listed
4.6.0
affected
custom
4.6.0.7
Unavailable
None listed
WSO2 Traffic Manager
Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.5.0
affected
custom
4.5.0.40
Unavailable
None listed
4.6.0
affected
custom
4.6.0.6
Unavailable
None listed
WSO2 Universal Gateway
Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts