CVE-2024-8008: api manager 3.1.0, 3.2.0, 3.2.1 (+4 more affected versions); +15 more affected products

Affected technology

api manager · 3.1.0
wso2

api manager · 3.2.0
wso2

api manager · 3.2.1
wso2

api manager · 4.0.0
wso2

api manager · 4.1.0
wso2

api manager · 4.2.0
wso2

api manager · 4.3.0
wso2

enterprise integrator · 6.6.0
wso2

identity server · 5.10.0
wso2

identity server · 5.11.0
wso2

identity server · 6.0.0
wso2

identity server · 6.1.0
wso2

identity server · 7.0.0
wso2

identity server as key manager · 5.10.0
wso2

open banking am · 2.0.0
wso2

open banking iam · 2.0.0
wso2

WSO2 Enterprise Integrator · 6.6.0 to before 6.6.0.211
WSO2

WSO2 API Manager · 3.1.0 to before 3.1.0.305, 3.2.0 to before 3.2.0.396, 3.2.1 to before 3.2.1.28, 4.0.0 to before 4.0.0.313, 4.1.0 to before 4.1.0.182, 4.2.0 to before 4.2.0.121, 4.3.0 to before 4.3.0.32, 4.4.0 to before 4.4.0.1, 4.5.0 to before 4.5.0.16
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.321
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.328, 5.11.0 to before 5.11.0.374, 6.0.0 to before 6.0.0.216, 6.1.0 to before 6.1.0.201, 7.0.0 to before 7.0.0.69
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.374
WSO2

WSO2 Open Banking AM · 2.0.0 to before 2.0.0.354
WSO2

WSO2 Traffic Manager · 4.5.0 to before 4.5.0.16
WSO2

WSO2 API Control Plane · 4.5.0 to before 4.5.0.17
WSO2

WSO2 Universal Gateway · 4.5.0 to before 4.5.0.16
WSO2

WSO2 Carbon Identity User Store Configuration UI · 5.14.127 to before 5.14.127.9, 5.17.5 to before 5.17.5.289, 5.17.118 to before 5.17.118.10, 5.18.187 to before 5.18.187.276, 5.18.248 to before 5.18.248.22, 5.23.8 to before 5.23.8.193, 5.24.8 to before 5.24.8.11, 5.25.92 to before 5.25.92.104, 5.25.705 to before 5.25.705.10, 5.25.713 to before 5.25.713.1, 5.25.724 to before 5.25.724.1, 7.0.78 to before 7.0.78.46
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Adjacent network · No privileges required · User interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 5.2/10) rates confidentiality and integrity impact as low; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.