CVE-2024-2321: Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are not required for API access, potentially enabling unauthorized operations.
Exploitation requires an attacker to obtain a valid refresh token of an admin user. Since refresh tokens generally have a longer expiration time, this could lead to prolonged unauthorized access to API resources, impacting data confidentiality and integrity.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2321?
CVE-2024-2321 is classified as a critical vulnerability due to its potential for unauthorized access to protected APIs.
How do I fix CVE-2024-2321?
To fix CVE-2024-2321, ensure that proper authorization checks are implemented in your application and revise token mapping for API access.
Which WSO2 products are affected by CVE-2024-2321?
CVE-2024-2321 affects multiple WSO2 products that utilize token-based authorization mechanisms.
What are the implications of CVE-2024-2321?
The implications of CVE-2024-2321 include potential unauthorized access to sensitive data through API endpoints using refresh tokens.
How can I mitigate the risks of CVE-2024-2321?
To mitigate the risks of CVE-2024-2321, implement stringent authorization controls and keep your WSO2 products updated with the latest security patches.