Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Wso2 |
|
Configuration 1 [-]
|
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
| Wso2 |
|
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-32097 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance. |
Solution
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/#solution
Workaround
No workaround given by the vendor.
Mon, 06 Oct 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:* |
Mon, 14 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Mon, 23 Jun 2025 13:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 23 Jun 2025 09:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance. | |
| Title | Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: WSO2
Published:
Updated: 2025-06-23T12:43:45.452Z
Reserved: 2024-04-09T12:08:02.707Z
Link: CVE-2024-3511
Vulnrichment
Updated: 2025-06-23T12:43:40.765Z
NVD
Status : Analyzed
Published: 2025-06-23T09:15:21.580
Modified: 2025-10-06T13:35:40.377
Link: CVE-2024-3511
Redhat
No data.
OpenCVE Enrichment
Updated: 2025-06-27T14:10:57Z