Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 2.0.0.383, 3.0.0.160, 3.1.0.335, 3.2.0.432, 3.2.1.51, and 26 more
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 2.0.0.383, 3.0.0.160, 3.1.0.335, 3.2.0.432, 3.2.1.51, or one of 26 more.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 12/100 · provisional
- Fix
- Fixed in 2.0.0.383, 3.0.0.160, 3.1.0.335, 3.2.0.432, 3.2.1.51, and 26 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
This vulnerability affects multiple WSO2 products, which are enterprise software platforms used for identity and API management. An attacker could exploit it by sending users a crafted link that redirects them to a malicious external site, enabling phishing attacks that may trick users into revealing sensitive information.
Read the original description
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
What to do
Upgrade to a fixed version: 2.0.0.383, 3.0.0.160, 3.1.0.335, 3.2.0.432, 3.2.1.51, or one of 26 more.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- WSO2 WSO2 Open Banking AM
From 2.0.0 · fixed in 2.0.0.383
- WSO2 WSO2 API Manager
From 3.0.0 · fixed in 3.0.0.160; From 3.1.0 · fixed in 3.1.0.335; From 3.2.0 · fixed in 3.2.0.432; From 3.2.1 · fixed in 3.2.1.51; From 4.0.0 · fixed in 4.0.0.310; From 4.1.0 · fixed in 4.1.0.208; From 4.2.0 · fixed in 4.2.0.146; From 4.3.0 · fixed in 4.3.0.59
- WSO2 WSO2 Identity Server as Key Manager
From 5.9.0 · fixed in 5.9.0.163; From 5.10.0 · fixed in 5.10.0.355
- WSO2 WSO2 Open Banking IAM
From 2.0.0 · fixed in 2.0.0.404
- WSO2 WSO2 Enterprise Integrator
From 6.6.0 · fixed in 6.6.0.212
- WSO2 WSO2 Identity Server
From 5.9.0 · fixed in 5.9.0.154; From 5.10.0 · fixed in 5.10.0.291; From 5.11.0 · fixed in 5.11.0.371; From 6.0.0 · fixed in 6.0.0.178; From 6.1.0 · fixed in 6.1.0.134
- org.wso2.carbon:org.wso2.carbon.registry.core
From 4.5.1 · fixed in 4.5.1.36; From 4.5.3 · fixed in 4.5.3.36; From 4.6.0 · fixed in 4.6.0.139; From 4.6.0 · fixed in 4.6.0.1544; From 4.6.1 · fixed in 4.6.1.105; From 4.6.2 · fixed in 4.6.2.321; From 4.6.3 · fixed in 4.6.3.28; From 4.6.4 · fixed in 4.6.4.11; From 4.7.1 · fixed in 4.7.1.47; From 4.8.1 · fixed in 4.8.1.27; From 4.8.1 · fixed in 4.8.1.31; From 4.9.0 · fixed in 4.9.0.46; From 4.9.26 · fixed in 4.9.26.18
Evidence 1
- Advisory
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.