2 lines
2.6 KiB
JSON
2 lines
2.6 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"status":"affected","version":"4.1.0","versionType":"custom"},{"status":"affected","version":"4.2.0","versionType":"custom"},{"status":"affected","version":"4.3.0","versionType":"custom"},{"status":"affected","version":"4.4.0","versionType":"custom"},{"status":"affected","version":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"status":"affected","version":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","packageName":"org.wso2.km.ext.wso2is:wso2is.key.manager.core","product":"WSO2 Identity Server Key Manager Connector (apim-km-wso2is)","vendor":"WSO2","versions":[{"lessThan":"1.8.8","status":"affected","version":"0","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint."}],"id":"CVE-2026-4052","lastModified":"2026-11-03T20:18:14.127","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-4052","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-11-03T20:08:03.683649Z","version":"2.0.3"}}]},"published":"2026-11-03T08:17:15.530","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|