CVE-2024-3511

{"id": "CVE-2024-3511", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-06-23T09:15:21.580", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-2702/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization.\n\nSuccessful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance."}, {"lang": "es", "value": "Existe una vulnerabilidad de autorizaci\u00f3n incorrecta en varios productos WSO2 que permite el acceso no autorizado a archivos versionados almacenados en el registro. Debido a una l\u00f3gica de autorizaci\u00f3n defectuosa, un agente malicioso con acceso a la consola de administraci\u00f3n puede explotar un m\u00e9todo de omisi\u00f3n espec\u00edfico para recuperar archivos versionados sin la debida autorizaci\u00f3n. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda conllevar la divulgaci\u00f3n no autorizada de archivos de configuraci\u00f3n o recursos que podr\u00edan estar almacenados como versiones del registro, lo que podr\u00eda facilitar nuevos ataques o el reconocimiento del sistema."}], "lastModified": "2025-10-06T13:35:40.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"}, {"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B81C488-69D0-4A5C-AEED-31869C1BF5CA"}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65CD2558-C60C-4296-8E96-D4D804C598F0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8DF49C6-F2F6-4229-982E-0C0559265203"}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1"}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063"}, {"criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}