The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled input within these headers. This omission allows an attacker to manipulate WS-Addressing headers to specify arbitrary destinations for server-initiated requests. Successful exploitation allows an unauthenticated attacker to control the destination of server-initiated requests originating from the WSO2 API Manager. This direct control can enable unauthorized access to internal network resources or services that would typically be inaccessible from external networks.
| Vendor | Product | Versions |
|---|---|---|
| wso2 | api_manager | 3.1.0, 3.2.0, 3.2.1, 4.0.0, 4.2.0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | open source wso2 api | cert_advisory | 90% |
Updated severity to CRITICAL, added affected version 3.0.0, and noted that no exploit is available.
Initial creation
