Wso2 Identity Server As Key Manager — known CVE vulnerabilities

Every CVE whose affected-product data names Wso2 Identity Server As Key Manager, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (42)

• CVE-2022-29464 — CVSS 9.8 (critical) — actively exploited: Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint…
• CVE-2025-9312 — CVSS 9.8 (critical): A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP…
• CVE-2025-10611 — CVSS 9.8 (critical): Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST…
• CVE-2024-6914 — CVSS 9.8 (critical): An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP…
• CVE-2025-9804 — CVSS 9.6 (critical): An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal…
• CVE-2021-42646 — CVSS 9.1 (critical): XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager…
• CVE-2020-24703 — CVSS 8.8 (high): An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled…
• CVE-2020-24705 — CVSS 8.8 (high): An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled…
• CVE-2025-6670 — CVSS 8.8 (high): A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing…
• CVE-2023-6837 — CVSS 8.5 (high): Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this…
• CVE-2025-10907 — CVSS 8.4 (high): An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination…
• CVE-2024-2374 — CVSS 7.5 (high): The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of…
• CVE-2020-12719 — CVSS 7.2 (high): XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and…
• CVE-2025-0663 — CVSS 6.8 (medium): A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive…
• CVE-2025-3125 — CVSS 6.7 (medium): An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin…
• CVE-2025-1862 — CVSS 6.7 (medium): An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL…
• CVE-2020-13883 — CVSS 6.7 (medium): In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows…
• CVE-2024-7073 — CVSS 6.5 (medium): A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin…
• CVE-2021-36760 — CVSS 6.1 (medium): In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the…
• CVE-2020-24706 — CVSS 6.1 (medium): An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager…
• CVE-2020-24704 — CVSS 6.1 (medium): An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager…
• CVE-2023-6838 — CVSS 6.1 (medium): Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both…
• CVE-2020-17453 — CVSS 6.1 (medium): WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
• CVE-2020-14446 — CVSS 6.1 (medium): An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.
• CVE-2025-5350 — CVSS 5.9 (medium): SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to…
• CVE-2020-14445 — CVSS 5.4 (medium): An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site…
• CVE-2018-20737 — CVSS 5.4 (medium): An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.
• CVE-2020-14444 — CVSS 5.4 (medium): An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site…
• CVE-2024-1440 — CVSS 5.4 (medium): An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication…
• CVE-2024-0391 — CVSS 5.3 (medium): The check user account lock states feature within the email OTP flow fails to validate user input, allowing an attacker to infer the…
• CVE-2025-10853 — CVSS 5.2 (medium): A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output…
• CVE-2024-8008 — CVSS 5.2 (medium): A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages…
• CVE-2023-6911 — CVSS 4.8 (medium): Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can…
• CVE-2023-6836 — CVSS 4.6 (medium): Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely…
• CVE-2022-29548 — CVSS 4.6 (medium): A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0…
• CVE-2025-5605 — CVSS 4.3 (medium): An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the…
• CVE-2024-7097 — CVSS 4.3 (medium): An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user…
• CVE-2024-3509 — CVSS 4.3 (medium): A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input…
• CVE-2024-3511 — CVSS 4.3 (medium): An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the…
• CVE-2024-7096 — CVSS 4.2 (medium): A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malicious…
• CVE-2025-1396 — CVSS 3.7 (low): A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the…
• CVE-2025-0672 — CVSS 3.3 (low): An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is…