Refine your search

2 vulnerabilities found for WSO2 Carbon User Manager Kernel by WSO2

CVE-2024-6832 (GCVE-0-2024-6832)
Vulnerability from cvelistv5
Published
2026-08-06 07:32
Modified
2026-08-06 12:34
CWE
  • CWE-693 - Protection Mechanism Failure
Summary
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence.
Impacted products
Vendor Product Version
WSO2 WSO2 Enterprise Integrator Version: 6.6.0   < 6.6.0.229
Create a notification for this product.
   WSO2 WSO2 API Control Plane Version: 4.5.0   < 4.5.0.40
Version: 4.6.0   < 4.6.0.4
Version: 4.6.0   < 4.6.0.5
Create a notification for this product.
   WSO2 WSO2 Traffic Manager Version: 4.5.0   < 4.5.0.38
Version: 4.6.0   < 4.6.0.4
Version: 4.6.0   < 4.6.0.5
Create a notification for this product.
   WSO2 WSO2 Universal Gateway Version: 4.5.0   < 4.5.0.38
Version: 4.6.0   < 4.6.0.4
Version: 4.6.0   < 4.6.0.5
Create a notification for this product.
   WSO2 WSO2 API Manager Version: 3.1.0   < 3.1.0.296
Version: 3.2.0   < 3.2.0.386
Version: 3.2.0   < 3.2.0.455
Version: 3.2.1   < 3.2.1.74
Version: 4.1.0   < 4.1.0.238
Version: 4.2.0   < 4.2.0.179
Version: 4.3.0   < 4.3.0.91
Version: 4.4.0   < 4.4.0.55
Version: 4.5.0   < 4.5.0.39
Version: 4.6.0   < 4.6.0.4
Create a notification for this product.
   WSO2 WSO2 Identity Server Version: 5.10.0   < 5.10.0.320
Version: 5.11.0   < 5.11.0.427
Version: 6.0.0   < 6.0.0.254
Version: 6.1.0   < 6.1.0.195
Version: 7.0.0   < 7.0.0.82
Create a notification for this product.
   WSO2 WSO2 Identity Server as Key Manager Version: 5.10.0   < 5.10.0.314
Create a notification for this product.
   WSO2 WSO2 Open Banking IAM Version: 2.0.0   < 2.0.0.366
Create a notification for this product.
   WSO2 WSO2 Open Banking AM Version: 2.0.0   < 2.0.0.345
Create a notification for this product.
   WSO2 WSO2 Carbon User Manager Kernel Version: 4.5.0   < 4.5.0.7
Version: 4.5.3   < 4.5.3.53
Version: 4.6.0   < 4.6.0.196
Version: 4.6.1   < 4.6.1.163
Version: 4.6.1   < 4.6.1.164
Version: 4.6.3   < 4.6.3.44
Version: 4.6.4   < 4.6.4.25
Version: 4.7.1   < 4.7.1.77
Version: 4.7.1   < 4.7.1.78
Version: 4.8.1   < 4.8.1.46
Version: 4.9.26   < 4.9.26.33
Version: 4.9.27   < 4.9.27.19
Version: 4.9.28   < 4.9.28.21
Version: 4.9.33   < 4.9.33.4
Version: 4.10.9   < 4.10.9.49
Patch: x
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-6832",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-06T12:34:22.435766Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-06T12:34:29.243Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.229",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.40",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.4",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.5",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.38",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.4",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.5",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.38",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.4",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.5",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.296",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.386",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.455",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.74",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.238",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.179",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.91",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.55",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.39",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.4",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.320",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.427",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.254",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.195",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.82",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.314",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.366",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.345",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.user.core",
          "product": "WSO2 Carbon User Manager Kernel",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.7",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.3.53",
              "status": "affected",
              "version": "4.5.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.196",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.163",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.164",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.44",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.25",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.77",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.78",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.46",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.33",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.19",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.21",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.33.4",
              "status": "affected",
              "version": "4.9.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.49",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores.\n\nWhen the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence."
            }
          ],
          "value": "The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores.\n\nWhen the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-281",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-281 CAPEC-281: Brute Force"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-06T07:32:59.256Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3352/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3352/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3352/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3352/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2024-3352",
        "discovery": "INTERNAL"
      },
      "title": "Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-6832",
    "datePublished": "2026-08-06T07:32:59.256Z",
    "dateReserved": "2024-07-17T11:44:02.821Z",
    "dateUpdated": "2026-08-06T12:34:29.243Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-3511 (GCVE-0-2024-3511)
Vulnerability from cvelistv5
Published
2025-06-23 08:47
Modified
2025-06-23 12:43
CWE
  • CWE-863 - Incorrect Authorization
Summary
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
Impacted products
Vendor Product Version
WSO2 WSO2 Enterprise Integrator Version: 6.6.0   < 6.6.0.205
Create a notification for this product.
   WSO2 WSO2 API Manager Version: 3.1.0   < 3.1.0.273
Version: 3.2.0   < 3.2.0.361
Version: 3.2.1   < 3.2.1.13
Version: 4.0.0   < 4.0.0.306
Version: 4.1.0   < 4.1.0.163
Version: 4.2.0   < 4.2.0.98
Version: 4.3.0   < 4.3.0.17
Create a notification for this product.
   WSO2 WSO2 Identity Server as Key Manager Version: 5.10.0   < 5.10.0.289
Create a notification for this product.
   WSO2 WSO2 Identity Server Version: 5.10.0   < 5.10.0.292
Version: 5.11.0   < 5.11.0.333
Version: 6.0.0   < 6.0.0.180
Version: 6.1.0   < 6.1.0.141
Version: 7.0.0   < 7.0.0.8
Create a notification for this product.
   WSO2 WSO2 Open Banking AM Version: 2.0.0   < 2.0.0.320
Create a notification for this product.
   WSO2 WSO2 Open Banking IAM Version: 2.0.0   < 2.0.0.341
Create a notification for this product.
   WSO2 WSO2 Carbon User Manager Kernel Version: 4.5.0   < 4.5.0.5
Version: 4.5.3   < 4.5.3.35
Version: 4.6.0   < 4.6.0.140
Version: 4.6.1   < 4.6.1.107
Version: 4.6.2   < 4.6.2.323
Version: 4.6.3   < 4.6.3.18
Version: 4.6.4   < 4.6.4.3
Version: 4.7.1   < 4.7.1.47
Version: 4.8.1   < 4.8.1.19
Version: 4.9.0   < 4.9.0.52
Version: 4.9.26   < 4.9.26.10
Version: 4.10.9   < 4.10.9.8
Patch: 4.10.13
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-3511",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-23T12:38:22.864048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-23T12:43:45.452Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.205",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.273",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.361",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.13",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.306",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.163",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.98",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.17",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.289",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.292",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.333",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.180",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.141",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.8",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.320",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.341",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.user.core",
          "product": "WSO2 Carbon User Manager Kernel",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.5",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.3.35",
              "status": "affected",
              "version": "4.5.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.140",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.107",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.323",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.18",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.3",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.47",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.19",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.52",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.10",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.8",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "4.10.13",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Viral Maniar - Security Researcher at Preemptive Cyber Security Pty Ltd"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.\u003cbr\u003e\u003cbr\u003eSuccessful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.\u003cbr\u003e"
            }
          ],
          "value": "An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.\n\nSuccessful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-23T08:47:55.266Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2024-2702",
        "discovery": "EXTERNAL"
      },
      "title": "Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-3511",
    "datePublished": "2025-06-23T08:47:55.266Z",
    "dateReserved": "2024-04-09T12:08:02.707Z",
    "dateUpdated": "2025-06-23T12:43:45.452Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}