CVE-2024-1248: Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation
WSO2 · WSO2 API Manager
Vendor fix available · Affected: WSO2 API Manager · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 23% of scored CVEs
DescriptionCVE.org
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user. Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When these conditions are met, a malicious individual can leverage the JIT provisioning process to modify the roles of local users. The overwritten roles are limited to those defined within the federated IDP, typically granting minimal access rights unless explicitly configured otherwise by the federated IDP administrator.
Affected products5
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- WSO2 · WSO2 API Managerfrom 3.0.0 before 3.0.0.153; from 3.1.0 before 3.1.0.267; from 3.2.0 before 3.2.0.351; from 4.0.0 before 4.0.0.269; from 4.1.0 before 4.1.0.169
- WSO2 · WSO2 Identity Serverfrom 5.8.0 before 5.8.0.101; from 5.9.0 before 5.9.0.138; from 5.10.0 before 5.10.0.284; from 5.11.0 before 5.11.0.321
- WSO2 · WSO2 Identity Server as Key Managerfrom 5.9.0 before 5.9.0.148; from 5.10.0 before 5.10.0.280
- WSO2 · WSO2 Open Banking AMfrom 2.0.0 before 2.0.0.313
- WSO2 · WSO2 Open Banking IAMfrom 2.0.0 before 2.0.0.333
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
CoverageNo articles yet
No CyberSIXT article names CVE-2024-1248 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.