The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements.
The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- WSO2
- Product
- WSO2 API Manager, WSO2 Traffic Manager, WSO2 API Control Plane
- CVSS v3.1
- 8.7 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
- Weakness
- CWE-89
- Exposure class
- Identity
- NVD status
- Received
Why it ranks 37 (Notable)
- CVSS v3.1 8.7 high
- Exposed product class: identity
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-2613 on this site · NVD · CVE.org · Vulnpedia