Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.0.0.22, 6.1.0.39, 6.1.1.43, 6.2.0.62, 6.3.0.70, and 14 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- WSO2 WSO2 Enterprise Integrator
From 6.0.0 · fixed in 6.0.0.22; From 6.1.0 · fixed in 6.1.0.39; From 6.1.1 · fixed in 6.1.1.43; From 6.2.0 · fixed in 6.2.0.62; From 6.3.0 · fixed in 6.3.0.70; From 6.4.0 · fixed in 6.4.0.100; From 6.5.0 · fixed in 6.5.0.107; From 6.6.0 · fixed in 6.6.0.222
- WSO2 WSO2 Enterprise Service Bus
From 5.0.0 · fixed in 5.0.0.29
- org.wso2.carbon:org.wso2.carbon.base
From 4.4.8 · fixed in 4.4.8.7; From 4.4.14 · fixed in 4.4.14.5; From 4.4.16 · fixed in 4.4.16.9; From 4.4.26 · fixed in 4.4.26.13; From 4.4.32 · fixed in 4.4.32.16; From 4.4.36 · fixed in 4.4.36.7; From 4.4.40 · fixed in 4.4.40.37; From 4.5.3 · fixed in 4.5.3.45; From 4.9 · fixed in 4.9.29; From 4.10 · fixed in 4.10.94
- org.wso2.carbon:org.wso2.carbon.server.admin
From 4.4.8 · fixed in 4.4.8.7; From 4.4.14 · fixed in 4.4.14.5; From 4.4.16 · fixed in 4.4.16.9; From 4.4.26 · fixed in 4.4.26.13; From 4.4.32 · fixed in 4.4.32.16; From 4.4.36 · fixed in 4.4.36.7; From 4.4.40 · fixed in 4.4.40.37; From 4.5.3 · fixed in 4.5.3.45; From 4.9 · fixed in 4.9.29; From 4.10 · fixed in 4.10.94