The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely.
Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 26
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Wso2 Api_Control_Plane
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*
|
4.5.0
|
4.5.0.36
|
|
Wso2 Api_Control_Plane
cpe:2.3:a:wso2:api_control_plane:4.6.0:*:*:*:*:*:*:*
|
— | — |
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
3.1.0
|
3.1.0.349
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
3.2.0
|
3.2.0.453
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
3.2.1
|
3.2.1.73
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
4.0.0
|
4.0.0.373
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
4.1.0
|
4.1.0.236
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
4.2.0
|
4.2.0.176
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
4.3.0
|
4.3.0.88
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
4.4.0
|
4.4.0.52
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
|
4.5.0
|
4.5.0.35
|
|
Wso2 Api_Manager
cpe:2.3:a:wso2:api_manager:4.6.0:*:*:*:*:*:*:*
|
— | — |
|
Wso2 Identity_Server
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
|
5.10.0
|
5.10.0.378
|
|
Wso2 Identity_Server
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
|
5.11.0
|
5.11.0.425
|
|
Wso2 Identity_Server
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
|
6.0.0
|
6.0.0.252
|
|
Wso2 Identity_Server
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
|
6.1.0
|
6.1.0.253
|
|
Wso2 Identity_Server
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
|
7.0.0
|
7.0.0.130
|
|
Wso2 Identity_Server
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*
|
7.1.0
|
7.1.0.38
|
|
Wso2 Identity_Server
cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*
|
— | — |
|
Wso2 Identity_Server_As_Key_Manager
cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*
|
5.10.0
|
5.10.0.369
|
|
Wso2 Open_Banking_Am
cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*
|
2.0.0
|
2.0.0.398
|
|
Wso2 Open_Banking_Iam
cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*
|
2.0.0
|
2.0.0.418
|
|
Wso2 Traffic_Manager
cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*
|
4.5.0
|
4.5.0.34
|
|
Wso2 Traffic_Manager
cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*
|
— | — |
|
Wso2 Universal_Gateway
cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*
|
4.5.0
|
4.5.0.34
|
|
Wso2 Universal_Gateway
cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*
|
— | — |