WSO2 API Manager token endpoint lets self-registered users gain admin privileges
Users who sign up on this web service manager can take over admin rights!
Summary
When WSO2 Identity Server runs as a Resident Key Manager with database sharing, a self-registered user can get a token from its token endpoint and reach the System REST APIs of WSO2 API Manager. This can lead to full administrative account takeover; API Manager 4.1.0 through 4.6.0 and API Control Plane 4.5.0 and 4.6.0 are affected.
Affected when
- WSO2 Identity Server configured as a Resident Key Manager with database sharing
- Self-registration of users enabled
What to do
Update WSO2 Identity Server and WSO2 API Manager to the latest U2 version. Replace the WSO2 IS connector with the latest version and restart the Identity Server deployments. Follow the steps in the advisory's solution section.
Products and platforms
CVE IDs
Sources
- Advisory: security.docs.wso2.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen