CVE-2024-2321 json
Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token
published 2025-02-27 20 mo ago modified 2026-06-17 4 mo ago also GHSA-6qjp-wm6g-m32r , EUVD-2024-27275
- cvss
- 5.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
An incorrect authorization vulnerability exists in multiple WSO2 products, allowing protected APIs to be accessed directly using a refresh token instead of the expected access token. Due to improper authorization checks and token mapping, session cookies are not required for API access, potentially enabling unauthorized operations.
Exploitation requires an attacker to obtain a valid refresh token of an admin user. Since refresh tokens generally have a longer expiration time, this could lead to prolonged unauthorized access to API resources, impacting data confidentiality and integrity.
Patch / fix
- WSO2 WSO2 API Manager 4.0.0.275, 4.1.0.153, 4.2.0.83
- WSO2 WSO2 Identity Server 5.11.0.326, 6.0.0.172, 6.1.0.130
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
| GitHub | 3.1 | 5.6 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.wso2.am:am-parent | >=4.2.0-beta, <=4.2.0 >=4.1.0-alpha, <=4.1.0 >=4.0.0-beta, <=4.0.0 |
no fix listed |
| maven | org.wso2.is:identity-server-parent | >=6.1.0-beta, <=6.1.0 >=6.0.0-alpha3, <=6.0.0 >=5.11.0-alpha, <=5.11.0 |
no fix listed |
Affected products
- WSO2 WSO2 API Manager
- WSO2 WSO2 Identity Server
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
security.docs.wso2.com
/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3213/
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-2321
advisory
-
github.com
/wso2/docs-security/blob/76bad9a2f38dc3377af476d0be52c6e775e3d864/en/docs/security-announcements/security-advi
web
-
security.docs.wso2.com
/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3213
web
Sources
- CVE List CVE-2024-2321
- GitHub Advisory GHSA-6qjp-wm6g-m32r
- NVD CVE-2024-2321
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.