{
  "document" : {
    "aggregate_severity" : {
      "text" : "hoch"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "WSO2 API Manager ist eine Open-Source-Plattform für das Management von APIs, die deren Erstellung, Veröffentlichung, Steuerung und Analyse ermöglicht.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein Angreifer kann mehrere Schwachstellen in WSO2 API Manager ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um seine Privilegien zu erhöhen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Daten zu manipulieren.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- Linux\n- UNIX",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2026-2085 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2085.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2026-2085 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2085"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4727/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4829/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4891/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4897/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5039/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5051/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5059/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5072/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5077/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5100/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5146/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5212/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5236/"
    }, {
      "category" : "external",
      "summary" : "WSO2 Security Advisory vom 2026-06-25",
      "url" : "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5328/"
    } ],
    "source_lang" : "en-US",
    "title" : "WSO2 API Manager: Mehrere Schwachstellen",
    "tracking" : {
      "current_release_date" : "2026-07-20T22:00:00.000+00:00",
      "generator" : {
        "date" : "2026-07-21T06:48:31.696+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.6.0"
        }
      },
      "id" : "WID-SEC-W-2026-2085",
      "initial_release_date" : "2026-06-25T22:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2026-06-25T22:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2026-06-28T22:00:00.000+00:00",
        "number" : "2",
        "summary" : "Referenz(en) aufgenommen: EUVD-2026-39638"
      }, {
        "date" : "2026-07-06T22:00:00.000+00:00",
        "number" : "3",
        "summary" : "Referenz(en) aufgenommen: EUVD-2026-41871"
      }, {
        "date" : "2026-07-20T22:00:00.000+00:00",
        "number" : "4",
        "summary" : "Referenz(en) aufgenommen: EUVD-2026-45898, GHSA-VCJ5-R64M-JR4F"
      } ],
      "status" : "final",
      "version" : "4"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "category" : "product_name",
        "name" : "Open Source WSO2 API Manager",
        "product" : {
          "name" : "Open Source WSO2 API Manager",
          "product_id" : "T055842",
          "product_identification_helper" : {
            "cpe" : "cpe:/a:wso2:api_manager:-"
          }
        }
      } ],
      "category" : "vendor",
      "name" : "Open Source"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2025-13173",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2025-13173"
  }, {
    "cve" : "CVE-2025-13394",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2025-13394"
  }, {
    "cve" : "CVE-2025-5717",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2025-5717"
  }, {
    "cve" : "CVE-2026-0637",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-0637"
  }, {
    "cve" : "CVE-2026-1728",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-1728"
  }, {
    "cve" : "CVE-2026-2053",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-2053"
  }, {
    "cve" : "CVE-2026-2445",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-2445"
  }, {
    "cve" : "CVE-2026-2613",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-2613"
  }, {
    "cve" : "CVE-2026-3415",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-3415"
  }, {
    "cve" : "CVE-2026-3418",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-3418"
  }, {
    "cve" : "CVE-2026-4052",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-4052"
  }, {
    "cve" : "CVE-2026-4249",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-4249"
  }, {
    "cve" : "CVE-2026-5430",
    "product_status" : {
      "known_affected" : [ "T055842" ]
    },
    "release_date" : "2026-06-25T22:00:00.000+00:00",
    "title" : "CVE-2026-5430"
  } ]
}