2 lines
7.6 KiB
JSON
2 lines
7.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.2.0.464","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.83","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.1.0.249","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.189","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.99","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.63","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.44","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.12","status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.45","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.13","status":"affected","version":"4.6.0","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*","matchCriteriaId":"26205605-D310-4FFD-86C8-257D09E852C0","versionEndExcluding":"4.5.0.50","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*","matchCriteriaId":"3D9CB4F7-E8B3-462D-B8C4-3688ACD7FED4","versionEndExcluding":"4.6.0.14","versionStartIncluding":"4.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"A649EA71-DCF7-4A0E-9645-17187952C33C","versionEndExcluding":"3.1.0.357","versionStartIncluding":"3.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"7F679042-FF0E-42DF-AA01-EC1571D5234F","versionEndExcluding":"3.2.0.465","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"ECFD7993-2946-4750-A0B9-8CB7AEC01C22","versionEndExcluding":"3.2.1.84","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"1176D495-7177-41BF-A1A3-CFD97BC99A1F","versionEndExcluding":"4.1.0.249","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"C1C2B451-1076-44AA-99C5-B42938BED88A","versionEndExcluding":"4.2.0.189","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"03D17142-622F-4593-B8F5-64AAE4D7BB79","versionEndExcluding":"4.3.0.100","versionStartIncluding":"4.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"7B37028B-8994-4CB1-B172-E6EC43BB1508","versionEndExcluding":"4.4.0.64","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"7E24CEED-2B35-4B4F-B9D5-78782216E680","versionEndExcluding":"4.5.0.49","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"C1A5531B-98FD-45BD-ADF1-8AB541905006","versionEndExcluding":"4.6.0.13","versionStartIncluding":"4.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","matchCriteriaId":"9150AB55-31B6-4F09-B8E7-3649098FFC5A","versionEndExcluding":"5.10.0.386","versionStartIncluding":"5.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","matchCriteriaId":"87330962-632C-425E-B0FF-190D6F6D24CA","versionEndExcluding":"5.11.0.433","versionStartIncluding":"5.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","matchCriteriaId":"46787CA9-9FB8-413F-9C17-665242D1AD26","versionEndExcluding":"6.0.0.260","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","matchCriteriaId":"40A42BB5-0825-495A-B112-4C9F8D545B61","versionEndExcluding":"6.1.0.261","versionStartIncluding":"6.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"A2B62C5B-A9B4-4357-9FC9-227C5A33E6F8","versionEndExcluding":"5.10.0.377","versionStartIncluding":"5.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*","matchCriteriaId":"CF3F568B-E0B9-4031-B1F6-45417255D8D1","versionEndExcluding":"2.0.0.406","versionStartIncluding":"2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*","matchCriteriaId":"4C4BABA2-3B16-44F3-9480-DCBF3D43ED85","versionEndExcluding":"2.0.0.426","versionStartIncluding":"2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"6DA9E881-C5F3-4129-A2BF-E412F78966FA","versionEndExcluding":"4.5.0.48","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"7246B9C1-E1DD-49C0-BCC3-4D030EA5B870","versionEndExcluding":"4.6.0.13","versionStartIncluding":"4.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"9B74DCC9-F644-4CB4-91A6-E82F64EC3B0E","versionEndExcluding":"4.5.0.49","versionStartIncluding":"4.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*","matchCriteriaId":"6D9A065C-C9AF-4E85-90D2-7A89920453E7","versionEndExcluding":"4.6.0.13","versionStartIncluding":"4.6.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs.\n\nAn attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation."}],"id":"CVE-2026-0637","lastModified":"2026-11-04T14:17:10.823","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0637","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-08-06T12:32:02.648926Z","version":"2.0.3"}}]},"published":"2026-08-06T08:16:29.453","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-20"},{"lang":"en","value":"CWE-74"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|