جزئیات آسیب‌پذیری
CVE-2025-1397
WSO2 JWT Grant Type For OAuth2WSO2 API Control PlaneWSO2 API ManagerWSO2 Carbon OAuthWSO2 Identity ServerWSO2 Identity Server as Key Manager
Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers
CVSS 3.1
4.8متوسط
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider (IDP) before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled. A malicious actor could leverage this vulnerability to obtain access tokens by targeting a disabled IDP. This could enable them to bypass intended security controls and potentially access protected resources that should be inaccessible due to the IDP's disabled state.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 4.8متوسط | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| WSO2 | JWT Grant Type For OAuth2 | 1.0.26 ≤ v < 1.0.26.6 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 1.0.26 ≤ v < 1.0.26.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 1.0.31 ≤ v < 1.0.31.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 1.1.0 ≤ v < 1.1.0.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 2.0.4 ≤ v < 2.0.4.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 2.1.1 ≤ v < 2.1.1.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 2.2.0 ≤ v < 2.2.0.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 2.2.4 ≤ v < 2.2.4.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | JWT Grant Type For OAuth2 | 2.3.1 ≤ v < 2.3.1.4 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Control Plane | 4.5.0 ≤ v < 4.5.0.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | v < 3.1.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.321 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.414 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.50 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.335 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.211 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.150 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.63 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.26 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.5.0 ≤ v < 4.5.0.10 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.11.21 ≤ v < 6.11.21.75 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.13.16 ≤ v < 6.13.16.15 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.13.19 ≤ v < 6.13.19.9 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.13.27 ≤ v < 6.13.27.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.111 ≤ v < 6.4.111.134 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.176 ≤ v < 6.4.176.25 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.180 ≤ v < 6.4.180.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.2 ≤ v < 6.4.2.155 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.8.0 ≤ v < 6.8.0.49 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.9.6 ≤ v < 6.9.6.22 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 7.0.26 ≤ v < 7.0.26.58 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.346 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.396 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.232 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.224 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.93 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.339 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.370 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.390 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | 4.5.0 ≤ v < 4.5.0.10 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | 4.5.0 ≤ v < 4.5.0.10 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۲
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۲
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- WSO2
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۱۵٪
احتمال بهره‌برداری در ۳۰ روز
۴٫۳٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- no
- Exploitation
- none
- Technical Impact
- partial
ضعف‌ها (CWE)
- CWE-862Missing Authentication for Critical Function