PT-2025-22560 · Wso2 · Wso2 Identity Server

Published 2025-05-22 · Updated 2025-05-22 · CVE-2024-7487

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 Identity Server version 7.0.0

Description An improper authentication issue exists due to an implementation flaw, allowing app-native authentication to be bypassed when an invalid object is passed. This could enable malicious actors to circumvent the client verification mechanism, compromising the integrity of the authentication process.

Recommendations For WSO2 Identity Server version 7.0.0, update to a version that fixes the improper authentication flaw to prevent the bypassing of app-native authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2024-7487

Affected Products

Wso2 Identity Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-7487 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7487 · Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3348 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925634600291782949 · Twitter Post