CVE-2024-3511: wso2 api_manager Incorrect Authorization

Vulnerability summary

CVE-2024-3511 is a medium (CVSS 4.3) Incorrect Authorization vulnerability in wso2 api_manager. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.2% of scored vulnerabilities.

Timeline

1. 23-06-2025
   PublishedVulnerability first disclosed.
2. 23-06-2025
   Last modifiedVulnerability information updated.

Description

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.