CVE-2024-8995

{"id": "CVE-2024-8995", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-8995", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T12:34:03.247293Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.320", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.413", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.90", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.334", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.255", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.195", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.106", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.70", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.55", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.19", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.54", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.19", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.56", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.20", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.55", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.19", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.369", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.345", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.395", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.229", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.208", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.389", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.338", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon OAuth", "versions": [{"status": "affected", "version": "6.4.2", "lessThan": "6.4.2.154", "versionType": "custom"}, {"status": "affected", "version": "6.4.111", "lessThan": "6.4.111.131", "versionType": "custom"}, {"status": "affected", "version": "6.4.176", "lessThan": "6.4.176.35", "versionType": "custom"}, {"status": "affected", "version": "6.4.180", "lessThan": "6.4.180.17", "versionType": "custom"}, {"status": "affected", "version": "6.8.0", "lessThan": "6.8.0.46", "versionType": "custom"}, {"status": "affected", "version": "6.9.6", "lessThan": "6.9.6.34", "versionType": "custom"}, {"status": "affected", "version": "6.11.21", "lessThan": "6.11.21.59", "versionType": "custom"}, {"status": "affected", "version": "6.13.16", "lessThan": "6.13.16.27", "versionType": "custom"}, {"status": "affected", "version": "6.13.19", "lessThan": "6.13.19.19", "versionType": "custom"}, {"status": "affected", "version": "6.13.27", "lessThan": "6.13.27.15", "versionType": "custom"}, {"status": "affected", "version": "6.13.41", "lessThan": "6.13.41.4", "versionType": "custom"}, {"status": "unaffected", "version": "6.11.53", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth", "defaultStatus": "unknown"}]}], "published": "2026-08-06T08:16:27.687", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-2753/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Unused authorization codes issued to deleted users are not being properly invalidated or removed from the system. This allows for the persistence of these codes, enabling them to be potentially reused.\n\nIf an attacker possesses both the authorization code and the associated client credentials (client ID and client secret), they can leverage these unused codes to obtain access tokens on behalf of users who have already been deleted. This may lead to unauthorized access to sensitive resources and services, contingent on the scopes originally authorized for the compromised authorization code."}], "lastModified": "2026-08-13T13:18:42.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41C885F7-D684-429D-8146-584001538308", "versionEndExcluding": "4.5.0.56", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8E40499-266E-4D78-B97B-053899472C28", "versionEndExcluding": "4.6.0.20", "versionStartIncluding": "4.6.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BC216C5-3DD9-4EBA-9C82-847D6245837B", "versionEndExcluding": "3.1.0.320", "versionStartIncluding": "3.1.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E29D3799-7305-4938-A4A1-78059F30477F", "versionEndExcluding": "3.2.0.413", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2659CF34-4AAF-41D4-8340-1E1C288B7376", "versionEndExcluding": "3.2.1.90", "versionStartIncluding": "3.2.1"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65410F15-284E-4F78-B49B-CAFA18F99D5B", "versionEndExcluding": "4.0.0.334", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F8A262B-0C9F-4A4E-9F04-F5EDBA617DC2", "versionEndExcluding": "4.1.0.255", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EBD5EB1-B5FD-463B-8B71-1E1206817A46", "versionEndExcluding": "4.2.0.195", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BFA9F60-1F08-40D0-9AFA-4575C1AB037C", "versionEndExcluding": "4.3.0.106", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C966B66E-F6E3-4169-83F6-3728103F39A7", "versionEndExcluding": "4.4.0.70", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "215F9941-8796-43A7-9737-D9DCA45E069D", "versionEndExcluding": "4.5.0.55", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94A7A69A-3506-4487-9831-6EAA799FEBC4", "versionEndExcluding": "4.6.0.19", "versionStartIncluding": "4.6.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "999EABFE-7961-45E0-8AEB-54C21FFA2C1D", "versionEndExcluding": "5.10.0.338", "versionStartIncluding": "5.10.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E567E8D-29E0-4BBC-B1D8-1D6DB2965F4E", "versionEndExcluding": "5.11.0.395", "versionStartIncluding": "5.11.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0825117F-5AB1-4531-A4E2-E46B885A652C", "versionEndExcluding": "6.0.0.229", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41AF9E4A-7C97-4706-A62E-4BD3A6742E18", "versionEndExcluding": "6.1.0.208", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C969C494-6227-417F-A72D-5A6E7897CD04", "versionEndExcluding": "5.10.0.338", "versionStartIncluding": "5.10.0"}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71273B35-5770-4DC5-9F72-DD676192BDDB", "versionEndExcluding": "2.0.0.369", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C3357CD-B7ED-409F-9E83-D2D98DED30D8", "versionEndExcluding": "2.0.0.389", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3589CF00-58E5-48DF-A0E5-6F4B14D5FDDF", "versionEndExcluding": "4.5.0.54", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F14FC462-1284-47E7-B7D6-0D2FA7196DB9", "versionEndExcluding": "4.6.0.19", "versionStartIncluding": "4.6.0"}, {"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AFD673A2-2B76-43F3-85E9-0100AE9E00A3", "versionEndExcluding": "4.5.0.55", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A61E3F9A-F643-46B5-9F67-A88B4701B9E1", "versionEndExcluding": "4.6.0.19", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}