جزئیات آسیب‌پذیری
CVE-2026-3583
WSO2 API Control PlaneWSO2 API ManagerWSO2 Carbon OAuthWSO2 Identity ServerWSO2 Identity Server as Key ManagerWSO2 Open Banking AM
Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
CVSS 3.1
3.1پایین
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the cache after a revocation request. This results in a scenario where an access token that was introspected immediately before a revocation request may be returned again to the client after revocation, until the relevant cache entry is cleared. The security consequence is that a revoked access token may be re-issued to the client during the cache lifetime. While the re-issued token is not treated as valid for API authorization, affected users may be unable to obtain a new valid access token until the cache is cleared, which can disrupt authentication flows.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 3.1پایین | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane | v < 4.5.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Control Plane | 4.5.0 ≤ v < 4.5.0.68 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Control Plane | 4.6.0 ≤ v < 4.6.0.30 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Control Plane | 4.7.0 ≤ v < 4.7.0.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | v < 3.1.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.367 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.475 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.106 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.394 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.267 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.207 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.120 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.83 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.5.0 ≤ v < 4.5.0.67 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.6.0 ≤ v < 4.6.0.29 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.7.0 ≤ v < 4.7.0.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.11.21 ≤ v < 6.11.21.118 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.13.16 ≤ v < 6.13.16.32 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.13.19 ≤ v < 6.13.19.23 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.13.27 ≤ v < 6.13.27.21 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.13.41 ≤ v < 6.13.41.9 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.14.14 ≤ v < 6.14.14.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.111 ≤ v < 6.4.111.174 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.176 ≤ v < 6.4.176.38 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.180 ≤ v < 6.4.180.25 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.4.2 ≤ v < 6.4.2.178 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.8.0 ≤ v < 6.8.0.59 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 6.9.6 ≤ v < 6.9.6.36 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 7.0.259 ≤ v < 7.0.259.54 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 7.0.26 ≤ v < 7.0.26.103 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 7.0.385 ≤ v < 7.0.385.15 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon OAuth | 7.4.99 ≤ v < 7.4.99.5 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.397 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.444 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.270 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.269 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.152 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.1.0 ≤ v < 7.1.0.61 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.2.0 ≤ v < 7.2.0.20 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.3.0 ≤ v < 7.3.0.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.387 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.414 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.434 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | v < 4.5.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | 4.5.0 ≤ v < 4.5.0.65 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | 4.6.0 ≤ v < 4.6.0.29 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | 4.7.0 ≤ v < 4.7.0.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | v < 4.5.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | 4.5.0 ≤ v < 4.5.0.67 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | 4.6.0 ≤ v < 4.6.0.29 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | 4.7.0 ≤ v < 4.7.0.3 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۰۶
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۰۷
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- WSO2
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۲۶٪
احتمال بهره‌برداری در ۳۰ روز
۱۸٫۳٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- no
- Exploitation
- none
- Technical Impact
- partial
ضعف‌ها (CWE)
- CWE-613Insufficient Session Expiration