WSO2 Identity Server Analytics vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting WSO2 Identity Server Analytics: 2 record(s), with affected versions and fixes.
cpe:2.3:a:wso2:identity_server_analytics

CVE-2025-9804 Medium · 6.5 CWE-284 Oct 16, 2025

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.

CVE-2022-29464 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-22 Apr 18, 2022

WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.