fkie_cve-2024-3511
Vulnerability from fkie_nvd
Published
2025-06-23 09:15
Modified
2025-06-23 20:16
Severity ?
Summary
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.
Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.\n\nSuccessful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de autorizaci\u00f3n incorrecta en varios productos WSO2 que permite el acceso no autorizado a archivos versionados almacenados en el registro. Debido a una l\u00f3gica de autorizaci\u00f3n defectuosa, un agente malicioso con acceso a la consola de administraci\u00f3n puede explotar un m\u00e9todo de omisi\u00f3n espec\u00edfico para recuperar archivos versionados sin la debida autorizaci\u00f3n. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda conllevar la divulgaci\u00f3n no autorizada de archivos de configuraci\u00f3n o recursos que podr\u00edan estar almacenados como versiones del registro, lo que podr\u00eda facilitar nuevos ataques o el reconocimiento del sistema."
}
],
"id": "CVE-2024-3511",
"lastModified": "2025-06-23T20:16:21.633",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4,
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary"
}
]
},
"published": "2025-06-23T09:15:21.580",
"references": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/"
}
],
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…