Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-1248: WSO2 Products: Privilege Escalation via Shared Usernames

CVE-2024-1248 · published 4 months ago

Summary

WSO2 software products are vulnerable to a security risk where an attacker can take control of a user's permissions if they know the user's username and the company uses a specific type of user authentication. This could allow the attacker to access sensitive information or perform actions they shouldn't be able to. To protect against this risk, administrators should review their user authentication settings and consider disabling silent JIT provisioning if possible.

What to do

Update wso2 wso2 api manager to version 3.0.0.153 or later.
Update wso2 wso2 identity server to version 5.8.0.101 or later.
Update wso2 wso2 identity server as key manager to version 5.9.0.148 or later.
Update wso2 wso2 open banking am to version 2.0.0.313 or later.
Update wso2 wso2 open banking iam to version 2.0.0.333 or later.
Update wso2 open_banking_am to version 2.0.0.313 or later.
Update wso2 open_banking_iam to version 2.0.0.333 or later.

Affected software

Vendor	Product	Affected versions
wso2	wso2 api manager	< 3.0.0.153
wso2	wso2 identity server	< 5.8.0.101
wso2	wso2 identity server as key manager	< 5.9.0.148
wso2	wso2 open banking am	< 2.0.0.313
wso2	wso2 open banking iam	< 2.0.0.333
wso2	api_manager	>= 3.0.0, < 3.0.0.153 >= 3.1.0, < 3.1.0.267 >= 3.2.0, < 3.2.0.351 >= 4.0.0, < 4.0.0.269 >= 4.1.0, < 4.1.0.169 `cpe:2.3:a:wso2:api_manager::::::::`
wso2	identity_server	>= 5.8.0, < 5.8.0.101 >= 5.9.0, < 5.9.0.138 >= 5.10.0, < 5.10.0.284 >= 5.11.0, < 5.11.0.321 `cpe:2.3:a:wso2:identity_server::::::::`
wso2	identity_server_as_key_manager	>= 5.9.0, < 5.9.0.148 >= 5.10.0, < 5.10.0.280 `cpe:2.3:a:wso2:identity_server_as_key_manager::::::::`
wso2	open_banking_am	>= 2.0.0, < 2.0.0.313 `cpe:2.3:a:wso2:open_banking_am::::::::`
wso2	open_banking_iam	>= 2.0.0, < 2.0.0.333 `cpe:2.3:a:wso2:open_banking_iam::::::::`

Original advisory text

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user.

Exploitation requires a federated identity provider (IDP) with silent JIT provisioning enabled and an attacker's knowledge of a local user's username. When these conditions are met, a malicious individual can leverage the JIT provisioning process to modify the roles of local users. The overwritten roles are limited to those defined within the federated IDP, typically granting minimal access rights unless explicitly configured otherwise by the federated IDP administrator.

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisor...

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-298Improper Validation of Certificate Expiration

Timeline

Published4 Jul 2026

Updated4 Nov 2026

First seen4 Jul 2026

Sources

CVE-2024-1248 · NVD

CVE-2024-1248 · MITRE

Track software like this

Free during beta