Wso2
Wso2 Enterprise Integrator: vulnerabilidades y CVE
Wso2 Enterprise Integrator tiene 35 vulnerabilidades publicadas, 12 de ellas en los últimos 12 meses. 2 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE35
Últimos 12 meses12
Críticas2
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2022-29464 | Crítica (9.8) | 100% | ⚠ Explotación activa | 18 abr 2022 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-3415 | Alta (8.7) | 0.49% | — | 6 ago 2026 | The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when… |
| CVE-2025-13394 | Media (5.4) | 0.14% | — | 6 ago 2026 | The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and… |
| CVE-2025-6670 | Alta (8.8) | 0.23% | — | 18 nov 2025 | A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the… |
| CVE-2025-10853 | Media (6.1) | 0.18% | — | 5 nov 2025 | A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject… |
| CVE-2025-11093 | Alta (7.2) | 0.44% | — | 5 nov 2025 | An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute… |
| CVE-2025-10907 | Alta (7.2) | 0.56% | — | 5 nov 2025 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can… |
| CVE-2025-10713 | Crítica (9.1) | 0.42% | — | 5 nov 2025 | An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing… |
| CVE-2025-3125 | Alta (7.2) | 0.85% | — | 5 nov 2025 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. An authenticated attacker with appropriate privileges can upload… |
| CVE-2025-5605 | Media (5.3) | 0.85% | — | 24 oct 2025 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain… |
| CVE-2025-5350 | Media (4.8) | 0.62% | — | 24 oct 2025 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper… |
| CVE-2025-9955 | Media (5.7) | 0.21% | — | 16 oct 2025 | An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A… |
| CVE-2025-9804 | Media (6.5) | 0.56% | — | 16 oct 2025 | An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this… |
| CVE-2025-1862 | Alta (7.2) | 0.54% | — | 26 sept 2025 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges… |
| CVE-2024-3511 | Media (4.3) | 0.21% | — | 23 jun 2025 | An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to… |
| CVE-2024-8008 | Media (5.2) | 0.53% | — | 2 jun 2025 | A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious… |
| CVE-2024-7074 | Media (6.8) | 17% | — | 2 jun 2025 | An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user input in SOAP admin services. A malicious actor with administrative privileges can upload an arbitrary file to a… |
| CVE-2024-3509 | Media (4.3) | 0.20% | — | 2 jun 2025 | A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this… |
| CVE-2024-0392 | Media (5.4) | 0.15% | — | 27 feb 2025 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the management console of WSO2 Enterprise Integrator 6.6.0 due to the absence of CSRF token validation. This flaw allows attackers to craft malicious requests… |
| CVE-2023-6911 | Media (4.8) | 0.41% | — | 18 dic 2023 | Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry… |
| CVE-2023-6836 | Alta (7.5) | 0.48% | — | 15 dic 2023 | Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. |
| CVE-2022-39810 | Media (6.1) | 57% | — | 9 sept 2022 | An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under… |
| CVE-2022-39809 | Media (6.1) | 0.55% | — | 9 sept 2022 | An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under… |
| CVE-2022-29548 | Media (6.1) | 41% | — | 21 abr 2022 | A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API… |
| CVE-2022-29464 | Crítica (9.8) | 100% | ⚠ Explotación activa | 18 abr 2022 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under… |
| CVE-2020-17453 | Media (6.1) | 26% | — | 5 abr 2021 | WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. |
| CVE-2020-25516 | Media (5.4) | 0.59% | — | 29 oct 2020 | WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. |
| CVE-2020-24704 | Media (6.1) | 0.72% | — | 27 ago 2020 | An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise… |
| CVE-2020-24703 | Alta (8.8) | 1.1% | — | 27 ago 2020 | An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This… |
| CVE-2020-24591 | Media (6.5) | 1.0% | — | 21 ago 2020 | The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise… |
| CVE-2020-12719 | Alta (7.2) | 1.0% | — | 8 may 2020 | XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.