Authorization Flaw in WSO2 Products Allows Direct API Access

CVE-2024-2321

What is CVE-2024-2321?

A vulnerability exists in multiple WSO2 products that allows unauthorized access to secured APIs by exploiting improper authorization checks. This can occur when an attacker utilizes a valid admin user refresh token, bypassing the necessary access token mechanism. As refresh tokens typically maintain longer validity, this misconfiguration can potentially grant enduring access to sensitive API resources, thereby jeopardizing data confidentiality and integrity. For detailed information and mitigation, refer to the vendor's advisory.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References