GHSA-j63j-7r7r-5v4j

Suggest an improvement
Source
https://github.com/advisories/GHSA-j63j-7r7r-5v4j
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-j63j-7r7r-5v4j/GHSA-j63j-7r7r-5v4j.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j63j-7r7r-5v4j
Aliases
Published
2025-05-30T15:30:31Z
Modified
2025-06-04T23:42:18Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services
Details

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious actor can create a new user with elevated permissions only when all of the following conditions are met:

  • SOAP admin services are accessible to the attacker.
  • The deployment includes an internally used attribute that is not part of the default WSO2 product configuration.
  • At least one custom role exists with non-default permissions.
  • The attacker has knowledge of the custom role and the internal attribute used in the deployment.

Exploiting this vulnerability allows malicious actors to assign higher privileges to self-registered users, bypassing intended access control mechanisms.

Database specific 
{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-06-04T23:09:07Z",
    "nvd_published_at":  "2025-05-30T15:15:40Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.wso2.am:am-parent

Package

Name
org.wso2.am:am-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.am/am-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
4.4.0

Affected versions

2.*
2.0.0
2.1.0-alpha
2.1.0
2.1.0-update1
2.1.0-update2
2.1.0-update3
2.1.0-update4
2.1.0-update5
2.1.0-update6
2.1.0-update7
2.1.0-update8
2.1.0-update9
2.1.0-update10
2.1.0-update11
2.1.0-update12
2.1.0-update13
2.1.0-update14
2.2.0-m1
2.2.0
2.2.0-update1
2.2.0-update2
2.2.0-update3
2.2.0-update4
2.2.0-update5
2.2.0-update6
2.2.0-update7
2.5.0-Alpha
2.5.0-Beta
2.5.0
2.6.0-alpha
2.6.0-alpha2
2.6.0-beta
2.6.0-beta2
2.6.0-m1
2.6.0-m2
2.6.0-rc1
2.6.0-rc2
2.6.0
3.*
3.0.0-alpha
3.0.0-beta
3.0.0-m3
3.0.0-m4
3.0.0-m5
3.0.0-m6
3.0.0-m7
3.0.0-m8
3.0.0-m9
3.0.0-m10
3.0.0-m11
3.0.0-m12
3.0.0-m15
3.0.0-m16
3.0.0-m17
3.0.0-m18
3.0.0-m19
3.0.0-m20
3.0.0-m21
3.0.0-m27
3.0.0-m29
3.0.0-m31
3.0.0-m32
3.0.0-m33
3.0.0-m35
3.0.0
3.0.0-,3
3.1.0-beta
3.1.0
3.2.0-alpha
3.2.0
4.*
4.0.0-beta
4.0.0
4.1.0-alpha
4.1.0-m1
4.1.0-m2
4.1.0-m3
4.1.0-m4
4.2.0-beta
4.2.0-m1
4.2.0
4.4.0-alpha

Database specific

last_known_affected_version_range 
"<= 4.3.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-j63j-7r7r-5v4j/GHSA-j63j-7r7r-5v4j.json"

Maven / org.wso2.is:identity-server-parent

Package

Name
org.wso2.is:identity-server-parent
View open source insights on deps.dev
Purl
pkg:maven/org.wso2.is/identity-server-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.2.0
Fixed
7.1.0

Affected versions

5.*
5.4.0-alpha4
5.4.0-alpha5
5.4.0-alpha6
5.4.0-alpha7
5.4.0-alpha8
5.4.0-alpha9
5.4.0-alpha10
5.4.0-beta
5.4.0
5.4.0-update1
5.4.0-update2
5.4.0-update3
5.4.0-update4
5.4.0-update5
5.4.0-update6
5.4.1
5.4.1-update1
5.4.1-update2
5.4.1-update3
5.4.1-update4
5.4.1-update5
5.5.0-alpha
5.5.0-alpha2
5.5.0-alpha3
5.5.0-beta
5.5.0-m1
5.5.0-m2
5.5.0-m3
5.5.0-m4
5.5.0
5.6.0-alpha
5.6.0-alpha2
5.6.0-beta
5.6.0-m1
5.6.0-m2
5.6.0-m3
5.6.0-m4
5.6.0-m5
5.6.0-m6
5.6.0-m7
5.6.0
5.7.0-alpha
5.7.0-alpha2
5.7.0-alpha3
5.7.0-beta
5.7.0-beta2
5.7.0-beta3
5.7.0-m1
5.7.0-m2
5.7.0-m3
5.7.0-m4
5.7.0-m5
5.7.0
5.8.0-beta4
5.8.0-beta5
5.8.0-m1
5.8.0-m2
5.8.0-m3
5.8.0-m4
5.8.0-m5
5.8.0-m6
5.8.0-m7
5.8.0-m8
5.8.0-m9
5.8.0-m10
5.8.0-m11
5.8.0-m12
5.8.0-m13
5.8.0-m14
5.8.0-m15
5.8.0-m16
5.8.0-m17
5.8.0-m18
5.8.0-m19
5.8.0-m20
5.8.0-m21
5.8.0-m22
5.8.0-m23
5.8.0-m24
5.8.0-m25
5.8.0-m26
5.8.0
5.8.1-m1
5.8.1-m2
5.9.0-beta
5.9.0
5.10.0-beta
5.10.0-beta2
5.10.0-beta3
5.10.0-m1
5.10.0-m2
5.10.0-m3
5.10.0-m9
5.10.0
5.10.1-m1
5.11.0-alpha
5.11.0-alpha2
5.11.0-alpha3
5.11.0-beta
5.11.0-beta2
5.11.0-beta3
5.11.0-beta4
5.11.0-beta5
5.11.0-m2
5.11.0-m3
5.11.0-m4
5.11.0-m5
5.11.0-m6
5.11.0-m7
5.11.0-m8
5.11.0-m9
5.11.0-m10
5.11.0-m11
5.11.0-m12
5.11.0-m13
5.11.0-m14
5.11.0-m15
5.11.0-m16
5.11.0-m17
5.11.0-m18
5.11.0-m19
5.11.0-m20
5.11.0-m21
5.11.0-m22
5.11.0-m23
5.11.0-m24
5.11.0-m25
5.11.0-m26
5.11.0-m27
5.11.0-m28
5.11.0-m29
5.11.0-m30
5.11.0-m31
5.11.0-m32
5.11.0-m33
5.11.0-m34
5.11.0-m35
5.12.0-alpha
5.12.0-alpha2
5.12.0-alpha3
5.12.0-alpha4
5.12.0-alpha5
5.12.0-alpha6
5.12.0-alpha7
5.12.0-alpha8
5.12.0-alpha9
5.12.0-alpha10
5.12.0-alpha11
5.12.0-alpha12
5.12.0-alpha13
5.12.0-alpha14
5.12.0-m1
5.12.0-m2
5.12.0-m3
5.12.0-m4
5.12.0-m5
5.12.0-m6
5.12.0-m7
5.12.0-m8
5.12.0-m9
5.12.0-m10
5.12.0-m11
5.12.0-m12
5.12.0-m13
5.12.0-m14
5.12.0-m15
5.12.0-m16
5.12.0-m17
5.12.0-m18
5.12.0-m19
5.12.0-m20
5.12.0-m21
5.12.0-m22
5.12.0-m23
5.12.0-m24
5.12.0-m25
5.12.0-m26
5.12.0-m27
5.12.0-m28
5.12.0-m29
5.12.0-m30
5.12.0-m31
5.12.0-m32
5.12.0-m33
5.12.0-m34
5.12.0-m35
5.13.0-m1
5.13.0-m2
5.13.0-m3
6.*
6.0.0-alpha3
6.0.0
6.1.0-beta
6.1.0-m1
6.1.0
7.*
7.0.0-beta5
7.0.0-beta6
7.1.0-m1
7.1.0-m7

Database specific

last_known_affected_version_range 
"<= 7.0.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-j63j-7r7r-5v4j/GHSA-j63j-7r7r-5v4j.json"