GHSA-6qjp-wm6g-m32r

Suggest an improvement
Source
https://github.com/advisories/GHSA-6qjp-wm6g-m32r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6qjp-wm6g-m32r/GHSA-6qjp-wm6g-m32r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-6qjp-wm6g-m32r
Aliases
Published
2025-02-27T06:30:53Z
Modified
2025-03-03T19:57:07Z
Severity
  • 5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
WSO2 incorrect authorization vulnerability
Details

An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are not required for API access, potentially enabling unauthorized operations.

Exploitation requires an attacker to obtain a valid refresh token of an admin user. Since refresh tokens generally have a longer expiration time, this could lead to prolonged unauthorized access to API resources, impacting data confidentiality and integrity.

Database specific 
{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-03T19:50:56Z",
    "nvd_published_at":  "2025-02-27T05:15:13Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven
org.wso2.am:am-parent

Package

Name
org.wso2.am:am-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.am/am-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2.0-beta
Last Affected
4.2.0

Affected versions

4.*
4.2.0-beta
4.2.0-m1
4.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6qjp-wm6g-m32r/GHSA-6qjp-wm6g-m32r.json"
org.wso2.am:am-parent

Package

Name
org.wso2.am:am-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.am/am-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0-alpha
Last Affected
4.1.0

Affected versions

4.*
4.1.0-alpha
4.1.0-m1
4.1.0-m2
4.1.0-m3
4.1.0-m4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6qjp-wm6g-m32r/GHSA-6qjp-wm6g-m32r.json"
org.wso2.am:am-parent

Package

Name
org.wso2.am:am-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.am/am-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.0.0-beta
Last Affected
4.0.0

Affected versions

4.*
4.0.0-beta
4.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6qjp-wm6g-m32r/GHSA-6qjp-wm6g-m32r.json"
org.wso2.is:identity-server-parent

Package

Name
org.wso2.is:identity-server-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.is/identity-server-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.1.0-beta
Last Affected
6.1.0

Affected versions

6.*
6.1.0-beta
6.1.0-m1
6.1.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6qjp-wm6g-m32r/GHSA-6qjp-wm6g-m32r.json"
org.wso2.is:identity-server-parent

Package

Name
org.wso2.is:identity-server-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.is/identity-server-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.0.0-alpha3
Last Affected
6.0.0

Affected versions

6.*
6.0.0-alpha3
6.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6qjp-wm6g-m32r/GHSA-6qjp-wm6g-m32r.json"
org.wso2.is:identity-server-parent

Package

Name
org.wso2.is:identity-server-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.is/identity-server-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.11.0-alpha
Last Affected
5.11.0

Affected versions

5.*
5.11.0-alpha
5.11.0-alpha2
5.11.0-alpha3
5.11.0-beta
5.11.0-beta2
5.11.0-beta3
5.11.0-beta4
5.11.0-beta5
5.11.0-m2
5.11.0-m3
5.11.0-m4
5.11.0-m5
5.11.0-m6
5.11.0-m7
5.11.0-m8
5.11.0-m9
5.11.0-m10
5.11.0-m11
5.11.0-m12
5.11.0-m13
5.11.0-m14
5.11.0-m15
5.11.0-m16
5.11.0-m17
5.11.0-m18
5.11.0-m19
5.11.0-m20
5.11.0-m21
5.11.0-m22
5.11.0-m23
5.11.0-m24
5.11.0-m25
5.11.0-m26
5.11.0-m27
5.11.0-m28
5.11.0-m29
5.11.0-m30
5.11.0-m31
5.11.0-m32
5.11.0-m33
5.11.0-m34
5.11.0-m35

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-6qjp-wm6g-m32r/GHSA-6qjp-wm6g-m32r.json"