CVE-2024-6423: WSO2 API Manager 3.1.0 to before 3.1.0.313, 3.2.0 to before 3.2.0.406, 3.2.1 to before 3.2.1.30, 4.0.0 to before…

Affected technology

WSO2 API Manager · 3.1.0 to before 3.1.0.313, 3.2.0 to before 3.2.0.406, 3.2.1 to before 3.2.1.30, 4.0.0 to before 4.0.0.324, 4.1.0 to before 4.1.0.185, 4.2.0 to before 4.2.0.124, 4.3.0 to before 4.3.0.36, 4.4.0 to before 4.4.0.2
WSO2

WSO2 Open Banking AM · 2.0.0 to before 2.0.0.363
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.337, 5.11.0 to before 5.11.0.384, 6.0.0 to before 6.0.0.213, 6.1.0 to before 6.1.0.211, 7.0.0 to before 7.0.0.50
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.329
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.381
WSO2

WSO2 Carbon Identity Application · 6.3.0 to before 6.3.0.18, 6.3.11 to before 6.3.11.23, 6.3.58 to before 6.3.58.1, 6.5.0 to before 6.5.0.5, 6.6.0 to before 6.6.0.1, 6.7.8 to before 6.7.8.4, 6.7.32 to before 6.7.32.1
WSO2

WSO2 Carbon Identity Core · 5.17.5 to before 5.17.5.286, 5.17.118 to before 5.17.118.11, 5.18.187 to before 5.18.187.263, 5.18.248 to before 5.18.248.23, 5.23.8 to before 5.23.8.189, 5.24.8 to before 5.24.8.12, 5.25.92 to before 5.25.92.91, 5.25.92 to before 5.25.92.118, 5.25.705 to before 5.25.705.11, 5.25.713 to before 5.25.713.2, 7.0.78 to before 7.0.78.27
WSO2

WSO2 Carbon Identity Oauth · 6.4.2 to before 6.4.2.142, 6.4.176 to before 6.4.176.20, 6.4.180 to before 6.4.180.8, 6.8.0 to before 6.8.0.40, 6.9.6 to before 6.9.6.16, 6.11.21 to before 6.11.21.44, 6.13.16 to before 6.13.16.6, 6.13.19 to before 6.13.19.2, 7.0.26 to before 7.0.26.18
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Local · High privileges required · User interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 4.0/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.