2 lines
7.6 KiB
JSON
2 lines
7.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.367","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.475","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.106","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.394","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.267","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.207","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.120","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.83","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.67","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.29","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.0.3","status":"affected","version":"4.7.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.65","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.29","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.0.3","status":"affected","version":"4.7.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.67","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.29","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.0.3","status":"affected","version":"4.7.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.5.0.68","status":"affected","version":"4.5.0","versionType":"custom"},{"lessThan":"4.6.0.30","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.7.0.3","status":"affected","version":"4.7.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.397","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.444","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.270","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.269","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.152","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.61","status":"affected","version":"7.1.0","versionType":"custom"},{"lessThan":"7.2.0.20","status":"affected","version":"7.2.0","versionType":"custom"},{"lessThan":"7.3.0.1","status":"affected","version":"7.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.434","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.387","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.414","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth","product":"WSO2 Carbon OAuth","vendor":"WSO2","versions":[{"lessThan":"6.4.2.178","status":"affected","version":"6.4.2","versionType":"custom"},{"lessThan":"6.4.111.174","status":"affected","version":"6.4.111","versionType":"custom"},{"lessThan":"6.4.176.38","status":"affected","version":"6.4.176","versionType":"custom"},{"lessThan":"6.4.180.25","status":"affected","version":"6.4.180","versionType":"custom"},{"lessThan":"6.8.0.59","status":"affected","version":"6.8.0","versionType":"custom"},{"lessThan":"6.9.6.36","status":"affected","version":"6.9.6","versionType":"custom"},{"lessThan":"6.11.21.118","status":"affected","version":"6.11.21","versionType":"custom"},{"lessThan":"6.13.16.32","status":"affected","version":"6.13.16","versionType":"custom"},{"lessThan":"6.13.19.23","status":"affected","version":"6.13.19","versionType":"custom"},{"lessThan":"6.13.27.21","status":"affected","version":"6.13.27","versionType":"custom"},{"lessThan":"6.13.41.9","status":"affected","version":"6.13.41","versionType":"custom"},{"lessThan":"6.14.14.3","status":"affected","version":"6.14.14","versionType":"custom"},{"lessThan":"7.0.26.103","status":"affected","version":"7.0.26","versionType":"custom"},{"lessThan":"7.0.259.54","status":"affected","version":"7.0.259","versionType":"custom"},{"lessThan":"7.0.385.15","status":"affected","version":"7.0.385","versionType":"custom"},{"lessThan":"7.4.99.5","status":"affected","version":"7.4.99","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.5.78","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared.\n\nThe security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows."}],"id":"CVE-2026-3583","lastModified":"2026-10-29T16:08:42.827","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","version":"3.1"},"exploitabilityScore":1.6,"impactScore":1.4,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3583","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-29T01:51:44.830935Z","version":"2.0.3"}}]},"published":"2026-10-28T20:17:24.340","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5175/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-613"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|