CVE-2024-3511
Estado: AnalizadaMedia (4.3)—
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.
Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.21%
- Percentil entre todas las CVEs puntuadas: 10
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (6)
CWE
- CWE-863
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-3511",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-3511",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-06-23T12:38:22.864048Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "ADJACENT_NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 Enterprise Integrator",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "6.6.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.6.0",
"lessThan": "6.6.0.205",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "3.1.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.1.0",
"lessThan": "3.1.0.273",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.0.361",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.1",
"lessThan": "3.2.1.13",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.0.0",
"lessThan": "4.0.0.306",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.1.0",
"lessThan": "4.1.0.163",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.2.0",
"lessThan": "4.2.0.98",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.3.0",
"lessThan": "4.3.0.17",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server as Key Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.289",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.292",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.11.0",
"lessThan": "5.11.0.333",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.0.0",
"lessThan": "6.0.0.180",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.1.0",
"lessThan": "6.1.0.141",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.0.0.8",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Open Banking AM",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.0.320",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Open Banking IAM",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.0.341",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon User Manager Kernel",
"versions": [
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.5.3",
"lessThan": "4.5.3.35",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.0",
"lessThan": "4.6.0.140",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.1",
"lessThan": "4.6.1.107",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.2",
"lessThan": "4.6.2.323",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.3",
"lessThan": "4.6.3.18",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.6.4",
"lessThan": "4.6.4.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.7.1",
"lessThan": "4.7.1.47",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.8.1",
"lessThan": "4.8.1.19",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.9.0",
"lessThan": "4.9.0.52",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.9.26",
"lessThan": "4.9.26.10",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.10.9",
"lessThan": "4.10.9.8",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "4.10.13",
"versionType": "custom",
"lessThanOrEqual": "*"
}
],
"packageName": "org.wso2.carbon:org.wso2.carbon.user.core",
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-06-23T09:15:21.580",
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/",
"tags": [
"Vendor Advisory"
],
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.\n\nSuccessful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de autorización incorrecta en varios productos WSO2 que permite el acceso no autorizado a archivos versionados almacenados en el registro. Debido a una lógica de autorización defectuosa, un agente malicioso con acceso a la consola de administración puede explotar un método de omisión específico para recuperar archivos versionados sin la debida autorización. La explotación exitosa de esta vulnerabilidad podría conllevar la divulgación no autorizada de archivos de configuración o recursos que podrían estar almacenados como versiones del registro, lo que podría facilitar nuevos ataques o el reconocimiento del sistema."
}
],
"lastModified": "2026-06-17T07:44:25.200",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"
},
{
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B81C488-69D0-4A5C-AEED-31869C1BF5CA"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "65CD2558-C60C-4296-8E96-D4D804C598F0"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B8DF49C6-F2F6-4229-982E-0C0559265203"
},
{
"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1"
},
{
"criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063"
},
{
"criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}