Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Priority LOW 23CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00141 3rd percentileScored 2026-11-07
Fix Fixed WSO2 Identity Server (WSO2): 5.10.0.381, 5.11.0.428, 6.0.0.255 +4WSO2 API Manager (WSO2): 3.1.0.352, 3.2.0.456, 3.2.1.75 +7+45 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WSO2 | WSO2 Identity Server | 5.10.0 to before 5.10.0.381; 5.11.0 to before 5.11.0.428; 6.0.0 to before 6.0.0.255; 6.1.0 to before 6.1.0.256; 7.0.0 to before 7.0.0.133; 7.1.0 to before 7.1.0.41; 7.2.0 to before 7.2.0.3 | 5.10.0.381, 5.11.0.428, 6.0.0.255, 6.1.0.256, 7.0.0.133, 7.1.0.41, 7.2.0.3 | Patch available | CNA |
| WSO2 | WSO2 API Manager | 3.1.0 to before 3.1.0.352; 3.2.0 to before 3.2.0.456; 3.2.1 to before 3.2.1.75; 4.0.0 to before 4.0.0.376; 4.1.0 to before 4.1.0.239; 4.2.0 to before 4.2.0.179; 4.3.0 to before 4.3.0.91; 4.4.0 to before 4.4.0.55; 4.5.0 to before 4.5.0.38; 4.6.0 to before 4.6.0.3 | 3.1.0.352, 3.2.0.456, 3.2.1.75, 4.0.0.376, 4.1.0.239, 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3 | Patch available | CNA |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 to before 2.0.0.421 | 2.0.0.421 | Patch available | CNA |
| WSO2 | WSO2 Open Banking AM | 2.0.0 to before 2.0.0.401 | 2.0.0.401 | Patch available | CNA |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 to before 5.10.0.372 | 5.10.0.372 | Patch available | CNA |
| WSO2 | WSO2 API Control Plane | 4.5.0 to before 4.5.0.39; 4.6.0 to before 4.6.0.3 | 4.5.0.39, 4.6.0.3 | Patch available | CNA |
| WSO2 | WSO2 Universal Gateway | 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 | 4.5.0.37, 4.6.0.3 | Patch available | CNA |
| WSO2 | WSO2 Traffic Manager | 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 | 4.5.0.37, 4.6.0.3 | Patch available | CNA |
| WSO2 | WSO2 Enterprise Integrator | 6.6.0 to before 6.6.0.227 | 6.6.0.227 | Patch available | CNA |
| WSO2 | WSO2 Carbon Identity Entitlement UI | 5.17.5 to before 5.17.5.331; 5.18.187 to before 5.18.187.329; 5.23.8 to before 5.23.8.210; 5.25.92 to before 5.25.92.166; 7.0.78 to before 7.0.78.157 | 5.17.5.331, 5.18.187.329, 5.23.8.210, 5.25.92.166, 7.0.78.157, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Identity Management UI1 | 5.17.5 to before 5.17.5.330; 5.17.5 to before 5.17.5.331; 5.17.118 to before 5.17.118.22; 5.18.187 to before 5.18.187.328; 5.18.187 to before 5.18.187.329; 5.18.248 to before 5.18.248.31; 5.23.8 to before 5.23.8.210; 5.24.8 to before 5.24.8.26; 5.25.92 to before 5.25.92.166; 5.25.705 to before 5.25.705.21; 5.25.713 to before 5.25.713.10; 5.25.724 to before 5.25.724.5; 5.25.736 to before 5.25.736.1; 7.0.78 to before 7.0.78.157; 7.8.23 to before 7.8.23.67; 7.8.586 to before 7.8.586.7 | 5.17.5.330, 5.17.5.331, 5.17.118.22, 5.18.187.328, 5.18.187.329, 5.18.248.31, 5.23.8.210, 5.24.8.26, 5.25.92.166, 5.25.705.21, 5.25.713.10, 5.25.724.5, 5.25.736.1, 7.0.78.157, 7.8.23.67, 7.8.586.7, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Identity User Store Configuration UI | 5.14.127 to before 5.14.127.13; 5.17.5 to before 5.17.5.330; 5.17.5 to before 5.17.5.331; 5.17.118 to before 5.17.118.22; 5.18.187 to before 5.18.187.328; 5.18.187 to before 5.18.187.329; 5.18.248 to before 5.18.248.31; 5.23.8 to before 5.23.8.210; 5.24.8 to before 5.24.8.26; 5.25.92 to before 5.25.92.166; 5.25.705 to before 5.25.705.21; 5.25.713 to before 5.25.713.10; 5.25.724 to before 5.25.724.5; 5.25.736 to before 5.25.736.1; 7.0.78 to before 7.0.78.157; 7.8.23 to before 7.8.23.67; 7.8.586 to before 7.8.586.7 | 5.14.127.13, 5.17.5.330, 5.17.5.331, 5.17.118.22, 5.18.187.328, 5.18.187.329, 5.18.248.31, 5.23.8.210, 5.24.8.26, 5.25.92.166, 5.25.705.21, 5.25.713.10, 5.25.724.5, 5.25.736.1, 7.0.78.157, 7.8.23.67, 7.8.586.7, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Registry Profiles UI | 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.24 to before 4.8.24.6; 4.8.43 to before 4.8.43.4; 4.8.50 to before 4.8.50.3 | 4.7.32.18, 4.7.33.16, 4.8.9.16, 4.8.12.8, 4.8.24.6, 4.8.43.4, 4.8.50.3, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Registry Properties UI | 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.13 to before 4.8.13.9; 4.8.24 to before 4.8.24.6; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.43 to before 4.8.43.4; 4.8.50 to before 4.8.50.1; 4.8.50 to before 4.8.50.3 | 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.43.4, 4.8.50.1, 4.8.50.3, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Registry Resources UI | 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.13 to before 4.8.13.9; 4.8.24 to before 4.8.24.6; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.43 to before 4.8.43.4; 4.8.50 to before 4.8.50.1; 4.8.50 to before 4.8.50.3 | 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.43.4, 4.8.50.1, 4.8.50.3, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Registry Search UI | 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.13 to before 4.8.13.9; 4.8.24 to before 4.8.24.6 | 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, x | Patch available | CNA |
| WSO2 | WSO2 Stratos User Interface For Tenant CRUD Operations | 4.8.1 to before 4.8.1.6; 4.8.7 to before 4.8.7.3; 4.9.8 to before 4.9.8.7; 4.9.10 to before 4.9.10.7; 4.9.10 to before 4.9.10.8; 4.9.20 to before 4.9.20.5; 4.9.27 to before 4.9.27.1; 4.9.31 to before 4.9.31.1; 4.9.34 to before 4.9.34.1; 4.9.42 to before 4.9.42.1; 4.11.0 to before 4.11.0.7; 4.11.19 to before 4.11.19.4; 4.11.34 to before 4.11.34.3; 4.11.45 to before 4.11.45.1 | 4.8.1.6, 4.8.7.3, 4.9.8.7, 4.9.10.7, 4.9.10.8, 4.9.20.5, 4.9.27.1, 4.9.31.1, 4.9.34.1, 4.9.42.1, 4.11.0.7, 4.11.19.4, 4.11.34.3, 4.11.45.1, x | Patch available | CNA |
| WSO2 | WSO2 Stratos SSO Redirector UI Component | 4.8.1 to before 4.8.1.6 | 4.8.1.6, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Email Verification UI | 4.7.19 to before 4.7.19.14 | 4.7.19.14, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Event Simulator UI | 2.2.11 to before 2.2.11.1; 2.2.14 to before 2.2.14.11; 2.2.14 to before 2.2.14.12; 2.2.17 to before 2.2.17.5; 2.3.1 to before 2.3.1.4; 2.3.5 to before 2.3.5.6 | 2.2.11.1, 2.2.14.11, 2.2.14.12, 2.2.17.5, 2.3.1.4, 2.3.5.6, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Execution Manager UI | 5.2.24 to before 5.2.24.10; 5.2.26 to before 5.2.26.22; 5.2.34 to before 5.2.34.12; 5.2.41 to before 5.2.41.7; 5.2.57 to before 5.2.57.10; 5.3.5 to before 5.3.5.9 | 5.2.24.10, 5.2.26.22, 5.2.34.12, 5.2.41.7, 5.2.57.10, 5.3.5.9, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Governance Custom Lifecycle Checklist UI | 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4 | 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Governance Generic Artifact User Interface | 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4; 4.8.33 to before 4.8.33.4; 4.8.34 to before 4.8.34.5; 4.8.37 to before 4.8.37.4 | 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, 4.8.33.4, 4.8.34.5, 4.8.37.4, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Governance Life Cycles User Interface | 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4 | 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Governance WSDL Tool UI | 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4; 4.8.33 to before 4.8.33.4; 4.8.34 to before 4.8.34.5; 4.8.37 to before 4.8.37.4 | 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, 4.8.33.4, 4.8.34.5, 4.8.37.4, x | Patch available | CNA |
| WSO2 | WSO2 Carbon New Data Sources UI | 4.7.19 to before 4.7.19.13; 4.7.24 to before 4.7.24.5; 4.7.32 to before 4.7.32.10; 4.7.35 to before 4.7.35.13; 4.7.49 to before 4.7.49.7; 4.7.52 to before 4.7.52.5; 4.9.2 to before 4.9.2.8; 4.9.11 to before 4.9.11.2; 4.9.18 to before 4.9.18.1 | 4.7.19.13, 4.7.24.5, 4.7.32.10, 4.7.35.13, 4.7.49.7, 4.7.52.5, 4.9.2.8, 4.9.11.2, 4.9.18.1, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Registry Info UI2 | 4.7.32 to before 4.7.32.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.13 to before 4.8.13.9; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.50 to before 4.8.50.1 | 4.7.32.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.13.9, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.50.1, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Registry Relations UI | 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.13 to before 4.8.13.9; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.50 to before 4.8.50.1 | 4.7.24.11, 4.7.32.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.13.9, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.50.1, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Registry Indexing | 4.7 to before 4.7.24 | 4.7.24, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Security UI | 5.14 to before 5.14.127 | 5.14.127, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Component Andes Event UI | 3.3.12 to before 3.3.12.3 | 3.3.12.3, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Component Andes UI1 | 3.3.12 to before 3.3.12.3 | 3.3.12.3, x | Patch available | CNA |
| WSO2 | WSO2 Carbon HL7 Business Messaging Store UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Endpoint Editor UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Publish Event Mediator Configuration UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Eventing UI | 4.7.19 to before 4.7.19.13 | 4.7.19.13, x | Patch available | CNA |
| WSO2 | WSO2 Carbon HumanTask UI | 4.5.27 to before 4.5.27.10 | 4.5.27.10, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Logging UI | 4.7.19 to before 4.7.19.13; 4.7.24 to before 4.7.24.5; 4.7.32 to before 4.7.32.10; 4.7.52 to before 4.7.52.5 | 4.7.19.13, 4.7.24.5, 4.7.32.10, 4.7.52.5, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Template Editor UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Command Mediator UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Rule Mediator UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Throttle Mediator UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Tasks Core | 4.7.19 to before 4.7.19.13 | 4.7.19.13, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Rest API Admin UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Sequence Editor UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Task UI | 4.7.30 to before 4.7.30.53 | 4.7.30.53, x | Patch available | CNA |
| WSO2 | WSO2 Carbon Governance | 4.8.37 to before 4.8.37.4 | 4.8.37.4, x | Patch available | CNA |
- WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.381; 5.11.0 to before 5.11.0.428; 6.0.0 to before 6.0.0.255; 6.1.0 to before 6.1.0.256; 7.0.0 to before 7.0.0.133; 7.1.0 to before 7.1.0.41; 7.2.0 to before 7.2.0.3 Fixed in 5.10.0.381, 5.11.0.428, 6.0.0.255, 6.1.0.256, 7.0.0.133, 7.1.0.41, 7.2.0.3 Patch available CNA
- WSO2 API Manager VendorWSO2 Affected 3.1.0 to before 3.1.0.352; 3.2.0 to before 3.2.0.456; 3.2.1 to before 3.2.1.75; 4.0.0 to before 4.0.0.376; 4.1.0 to before 4.1.0.239; 4.2.0 to before 4.2.0.179; 4.3.0 to before 4.3.0.91; 4.4.0 to before 4.4.0.55; 4.5.0 to before 4.5.0.38; 4.6.0 to before 4.6.0.3 Fixed in 3.1.0.352, 3.2.0.456, 3.2.1.75, 4.0.0.376, 4.1.0.239, 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3 Patch available CNA
- WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.421 Fixed in 2.0.0.421 Patch available CNA
- WSO2 Open Banking AM VendorWSO2 Affected 2.0.0 to before 2.0.0.401 Fixed in 2.0.0.401 Patch available CNA
- WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.372 Fixed in 5.10.0.372 Patch available CNA
- WSO2 API Control Plane VendorWSO2 Affected 4.5.0 to before 4.5.0.39; 4.6.0 to before 4.6.0.3 Fixed in 4.5.0.39, 4.6.0.3 Patch available CNA
- WSO2 Universal Gateway VendorWSO2 Affected 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 Fixed in 4.5.0.37, 4.6.0.3 Patch available CNA
- WSO2 Traffic Manager VendorWSO2 Affected 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 Fixed in 4.5.0.37, 4.6.0.3 Patch available CNA
- WSO2 Enterprise Integrator VendorWSO2 Affected 6.6.0 to before 6.6.0.227 Fixed in 6.6.0.227 Patch available CNA
- WSO2 Carbon Identity Entitlement UI VendorWSO2 Affected 5.17.5 to before 5.17.5.331; 5.18.187 to before 5.18.187.329; 5.23.8 to before 5.23.8.210; 5.25.92 to before 5.25.92.166; 7.0.78 to before 7.0.78.157 Fixed in 5.17.5.331, 5.18.187.329, 5.23.8.210, 5.25.92.166, 7.0.78.157, x Patch available CNA
- WSO2 Carbon Identity Management UI1 VendorWSO2 Affected 5.17.5 to before 5.17.5.330; 5.17.5 to before 5.17.5.331; 5.17.118 to before 5.17.118.22; 5.18.187 to before 5.18.187.328; 5.18.187 to before 5.18.187.329; 5.18.248 to before 5.18.248.31; 5.23.8 to before 5.23.8.210; 5.24.8 to before 5.24.8.26; 5.25.92 to before 5.25.92.166; 5.25.705 to before 5.25.705.21; 5.25.713 to before 5.25.713.10; 5.25.724 to before 5.25.724.5; 5.25.736 to before 5.25.736.1; 7.0.78 to before 7.0.78.157; 7.8.23 to before 7.8.23.67; 7.8.586 to before 7.8.586.7 Fixed in 5.17.5.330, 5.17.5.331, 5.17.118.22, 5.18.187.328, 5.18.187.329, 5.18.248.31, 5.23.8.210, 5.24.8.26, 5.25.92.166, 5.25.705.21, 5.25.713.10, 5.25.724.5, 5.25.736.1, 7.0.78.157, 7.8.23.67, 7.8.586.7, x Patch available CNA
- WSO2 Carbon Identity User Store Configuration UI VendorWSO2 Affected 5.14.127 to before 5.14.127.13; 5.17.5 to before 5.17.5.330; 5.17.5 to before 5.17.5.331; 5.17.118 to before 5.17.118.22; 5.18.187 to before 5.18.187.328; 5.18.187 to before 5.18.187.329; 5.18.248 to before 5.18.248.31; 5.23.8 to before 5.23.8.210; 5.24.8 to before 5.24.8.26; 5.25.92 to before 5.25.92.166; 5.25.705 to before 5.25.705.21; 5.25.713 to before 5.25.713.10; 5.25.724 to before 5.25.724.5; 5.25.736 to before 5.25.736.1; 7.0.78 to before 7.0.78.157; 7.8.23 to before 7.8.23.67; 7.8.586 to before 7.8.586.7 Fixed in 5.14.127.13, 5.17.5.330, 5.17.5.331, 5.17.118.22, 5.18.187.328, 5.18.187.329, 5.18.248.31, 5.23.8.210, 5.24.8.26, 5.25.92.166, 5.25.705.21, 5.25.713.10, 5.25.724.5, 5.25.736.1, 7.0.78.157, 7.8.23.67, 7.8.586.7, x Patch available CNA
- WSO2 Carbon Registry Profiles UI VendorWSO2 Affected 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.24 to before 4.8.24.6; 4.8.43 to before 4.8.43.4; 4.8.50 to before 4.8.50.3 Fixed in 4.7.32.18, 4.7.33.16, 4.8.9.16, 4.8.12.8, 4.8.24.6, 4.8.43.4, 4.8.50.3, x Patch available CNA
- WSO2 Carbon Registry Properties UI VendorWSO2 Affected 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.13 to before 4.8.13.9; 4.8.24 to before 4.8.24.6; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.43 to before 4.8.43.4; 4.8.50 to before 4.8.50.1; 4.8.50 to before 4.8.50.3 Fixed in 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.43.4, 4.8.50.1, 4.8.50.3, x Patch available CNA
- WSO2 Carbon Registry Resources UI VendorWSO2 Affected 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.13 to before 4.8.13.9; 4.8.24 to before 4.8.24.6; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.43 to before 4.8.43.4; 4.8.50 to before 4.8.50.1; 4.8.50 to before 4.8.50.3 Fixed in 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.43.4, 4.8.50.1, 4.8.50.3, x Patch available CNA
- WSO2 Carbon Registry Search UI VendorWSO2 Affected 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.32 to before 4.7.32.18; 4.7.33 to before 4.7.33.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.9 to before 4.8.9.16; 4.8.12 to before 4.8.12.8; 4.8.13 to before 4.8.13.9; 4.8.24 to before 4.8.24.6 Fixed in 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, x Patch available CNA
- WSO2 Stratos User Interface For Tenant CRUD Operations VendorWSO2 Affected 4.8.1 to before 4.8.1.6; 4.8.7 to before 4.8.7.3; 4.9.8 to before 4.9.8.7; 4.9.10 to before 4.9.10.7; 4.9.10 to before 4.9.10.8; 4.9.20 to before 4.9.20.5; 4.9.27 to before 4.9.27.1; 4.9.31 to before 4.9.31.1; 4.9.34 to before 4.9.34.1; 4.9.42 to before 4.9.42.1; 4.11.0 to before 4.11.0.7; 4.11.19 to before 4.11.19.4; 4.11.34 to before 4.11.34.3; 4.11.45 to before 4.11.45.1 Fixed in 4.8.1.6, 4.8.7.3, 4.9.8.7, 4.9.10.7, 4.9.10.8, 4.9.20.5, 4.9.27.1, 4.9.31.1, 4.9.34.1, 4.9.42.1, 4.11.0.7, 4.11.19.4, 4.11.34.3, 4.11.45.1, x Patch available CNA
- WSO2 Stratos SSO Redirector UI Component VendorWSO2 Affected 4.8.1 to before 4.8.1.6 Fixed in 4.8.1.6, x Patch available CNA
- WSO2 Carbon Email Verification UI VendorWSO2 Affected 4.7.19 to before 4.7.19.14 Fixed in 4.7.19.14, x Patch available CNA
- WSO2 Carbon Event Simulator UI VendorWSO2 Affected 2.2.11 to before 2.2.11.1; 2.2.14 to before 2.2.14.11; 2.2.14 to before 2.2.14.12; 2.2.17 to before 2.2.17.5; 2.3.1 to before 2.3.1.4; 2.3.5 to before 2.3.5.6 Fixed in 2.2.11.1, 2.2.14.11, 2.2.14.12, 2.2.17.5, 2.3.1.4, 2.3.5.6, x Patch available CNA
- WSO2 Carbon Execution Manager UI VendorWSO2 Affected 5.2.24 to before 5.2.24.10; 5.2.26 to before 5.2.26.22; 5.2.34 to before 5.2.34.12; 5.2.41 to before 5.2.41.7; 5.2.57 to before 5.2.57.10; 5.3.5 to before 5.3.5.9 Fixed in 5.2.24.10, 5.2.26.22, 5.2.34.12, 5.2.41.7, 5.2.57.10, 5.3.5.9, x Patch available CNA
- WSO2 Carbon Governance Custom Lifecycle Checklist UI VendorWSO2 Affected 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4 Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, x Patch available CNA
- WSO2 Carbon Governance Generic Artifact User Interface VendorWSO2 Affected 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4; 4.8.33 to before 4.8.33.4; 4.8.34 to before 4.8.34.5; 4.8.37 to before 4.8.37.4 Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, 4.8.33.4, 4.8.34.5, 4.8.37.4, x Patch available CNA
- WSO2 Carbon Governance Life Cycles User Interface VendorWSO2 Affected 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4 Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, x Patch available CNA
- WSO2 Carbon Governance WSDL Tool UI VendorWSO2 Affected 4.8.14 to before 4.8.14.4; 4.8.19 to before 4.8.19.8; 4.8.21 to before 4.8.21.10; 4.8.28 to before 4.8.28.4; 4.8.30 to before 4.8.30.6; 4.8.32 to before 4.8.32.4; 4.8.33 to before 4.8.33.4; 4.8.34 to before 4.8.34.5; 4.8.37 to before 4.8.37.4 Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, 4.8.33.4, 4.8.34.5, 4.8.37.4, x Patch available CNA
- WSO2 Carbon New Data Sources UI VendorWSO2 Affected 4.7.19 to before 4.7.19.13; 4.7.24 to before 4.7.24.5; 4.7.32 to before 4.7.32.10; 4.7.35 to before 4.7.35.13; 4.7.49 to before 4.7.49.7; 4.7.52 to before 4.7.52.5; 4.9.2 to before 4.9.2.8; 4.9.11 to before 4.9.11.2; 4.9.18 to before 4.9.18.1 Fixed in 4.7.19.13, 4.7.24.5, 4.7.32.10, 4.7.35.13, 4.7.49.7, 4.7.52.5, 4.9.2.8, 4.9.11.2, 4.9.18.1, x Patch available CNA
- WSO2 Carbon Registry Info UI2 VendorWSO2 Affected 4.7.32 to before 4.7.32.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.13 to before 4.8.13.9; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.50 to before 4.8.50.1 Fixed in 4.7.32.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.13.9, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.50.1, x Patch available CNA
- WSO2 Carbon Registry Relations UI VendorWSO2 Affected 4.7.24 to before 4.7.24.11; 4.7.32 to before 4.7.32.16; 4.7.35 to before 4.7.35.15; 4.7.39 to before 4.7.39.12; 4.7.51 to before 4.7.51.8; 4.8.3 to before 4.8.3.10; 4.8.13 to before 4.8.13.9; 4.8.32 to before 4.8.32.4; 4.8.36 to before 4.8.36.2; 4.8.43 to before 4.8.43.2; 4.8.50 to before 4.8.50.1 Fixed in 4.7.24.11, 4.7.32.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.13.9, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.50.1, x Patch available CNA
- WSO2 Carbon Registry Indexing VendorWSO2 Affected 4.7 to before 4.7.24 Fixed in 4.7.24, x Patch available CNA
- WSO2 Carbon Security UI VendorWSO2 Affected 5.14 to before 5.14.127 Fixed in 5.14.127, x Patch available CNA
- WSO2 Carbon Component Andes Event UI VendorWSO2 Affected 3.3.12 to before 3.3.12.3 Fixed in 3.3.12.3, x Patch available CNA
- WSO2 Carbon Component Andes UI1 VendorWSO2 Affected 3.3.12 to before 3.3.12.3 Fixed in 3.3.12.3, x Patch available CNA
- WSO2 Carbon HL7 Business Messaging Store UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Endpoint Editor UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Publish Event Mediator Configuration UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Eventing UI VendorWSO2 Affected 4.7.19 to before 4.7.19.13 Fixed in 4.7.19.13, x Patch available CNA
- WSO2 Carbon HumanTask UI VendorWSO2 Affected 4.5.27 to before 4.5.27.10 Fixed in 4.5.27.10, x Patch available CNA
- WSO2 Carbon Logging UI VendorWSO2 Affected 4.7.19 to before 4.7.19.13; 4.7.24 to before 4.7.24.5; 4.7.32 to before 4.7.32.10; 4.7.52 to before 4.7.52.5 Fixed in 4.7.19.13, 4.7.24.5, 4.7.32.10, 4.7.52.5, x Patch available CNA
- WSO2 Carbon Template Editor UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Command Mediator UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Rule Mediator UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Throttle Mediator UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Tasks Core VendorWSO2 Affected 4.7.19 to before 4.7.19.13 Fixed in 4.7.19.13, x Patch available CNA
- WSO2 Carbon Rest API Admin UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Sequence Editor UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Task UI VendorWSO2 Affected 4.7.30 to before 4.7.30.53 Fixed in 4.7.30.53, x Patch available CNA
- WSO2 Carbon Governance VendorWSO2 Affected 4.8.37 to before 4.8.37.4 Fixed in 4.8.37.4, x Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* | 4.5.0 to before 4.5.0.39; 4.6.0 to before 4.6.0.3 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* | 3.1.0 to before 3.1.0.352; 3.2.0 to before 3.2.0.456; 3.2.1 to before 3.2.1.75; 4.0.0 to before 4.0.0.376; 4.1.0 to before 4.1.0.239; 4.2.0 to before 4.2.0.179; 4.3.0 to before 4.3.0.91; 4.4.0 to before 4.4.0.55; 4.5.0 to before 4.5.0.38; 4.6.0 to before 4.6.0.3 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:* | 6.6.0 to before 6.6.0.227 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* | 5.10.0 to before 5.10.0.381; 5.11.0 to before 5.11.0.428; 6.0.0 to before 6.0.0.255; 6.1.0 to before 6.1.0.256; 7.0.0 to before 7.0.0.133; 7.1.0 to before 7.1.0.41; 7.2.0 to before 7.2.0.3 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:* | 5.10.0 to before 5.10.0.372 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:* | 2.0.0 to before 2.0.0.401 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:* | 2.0.0 to before 2.0.0.421 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* | 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 | Vulnerable | WSO2 |
| cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* | 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 | Vulnerable | WSO2 |
- cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.39; 4.6.0 to before 4.6.0.3 Vulnerable ·WSO2
- cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.1.0.352; 3.2.0 to before 3.2.0.456; 3.2.1 to before 3.2.1.75; 4.0.0 to before 4.0.0.376; 4.1.0 to before 4.1.0.239; 4.2.0 to before 4.2.0.179; 4.3.0 to before 4.3.0.91; 4.4.0 to before 4.4.0.55; 4.5.0 to before 4.5.0.38; 4.6.0 to before 4.6.0.3 Vulnerable ·WSO2
- cpe:2.3:a:wso2:enterprise_integrator:*:*:*:*:*:*:*:* Versions 6.6.0 to before 6.6.0.227 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions 5.10.0 to before 5.10.0.381; 5.11.0 to before 5.11.0.428; 6.0.0 to before 6.0.0.255; 6.1.0 to before 6.1.0.256; 7.0.0 to before 7.0.0.133; 7.1.0 to before 7.1.0.41; 7.2.0 to before 7.2.0.3 Vulnerable ·WSO2
- cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:* Versions 5.10.0 to before 5.10.0.372 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.0.401 Vulnerable ·WSO2
- cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.0.421 Vulnerable ·WSO2
- cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 Vulnerable ·WSO2
- cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:* Versions 4.5.0 to before 4.5.0.37; 4.6.0 to before 4.6.0.3 Vulnerable ·WSO2
Remediation
- Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.381, 5.11.0.428, 6.0.0.255, 6.1.0.256, 7.0.0.133, 7.1.0.41, 7.2.0.3
- Fix · CNA WSO2 API Manager (WSO2) Fixed in 3.1.0.352, 3.2.0.456, 3.2.1.75, 4.0.0.376, 4.1.0.239, 4.2.0.179, 4.3.0.91, 4.4.0.55, 4.5.0.38, 4.6.0.3
- Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.421
- Fix · CNA WSO2 Open Banking AM (WSO2) Fixed in 2.0.0.401
- Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.372
- Fix · CNA WSO2 API Control Plane (WSO2) Fixed in 4.5.0.39, 4.6.0.3
- Fix · CNA WSO2 Universal Gateway (WSO2) Fixed in 4.5.0.37, 4.6.0.3
- Fix · CNA WSO2 Traffic Manager (WSO2) Fixed in 4.5.0.37, 4.6.0.3
- Fix · CNA WSO2 Enterprise Integrator (WSO2) Fixed in 6.6.0.227
- Fix · CNA WSO2 Carbon Identity Entitlement UI (WSO2) Fixed in 5.17.5.331, 5.18.187.329, 5.23.8.210, 5.25.92.166, 7.0.78.157, x
- Fix · CNA WSO2 Carbon Identity Management UI1 (WSO2) Fixed in 5.17.5.330, 5.17.5.331, 5.17.118.22, 5.18.187.328, 5.18.187.329, 5.18.248.31, 5.23.8.210, 5.24.8.26, 5.25.92.166, 5.25.705.21, 5.25.713.10, 5.25.724.5, 5.25.736.1, 7.0.78.157, 7.8.23.67, 7.8.586.7, x
- Fix · CNA WSO2 Carbon Identity User Store Configuration UI (WSO2) Fixed in 5.14.127.13, 5.17.5.330, 5.17.5.331, 5.17.118.22, 5.18.187.328, 5.18.187.329, 5.18.248.31, 5.23.8.210, 5.24.8.26, 5.25.92.166, 5.25.705.21, 5.25.713.10, 5.25.724.5, 5.25.736.1, 7.0.78.157, 7.8.23.67, 7.8.586.7, x
- Fix · CNA WSO2 Carbon Registry Profiles UI (WSO2) Fixed in 4.7.32.18, 4.7.33.16, 4.8.9.16, 4.8.12.8, 4.8.24.6, 4.8.43.4, 4.8.50.3, x
- Fix · CNA WSO2 Carbon Registry Properties UI (WSO2) Fixed in 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.43.4, 4.8.50.1, 4.8.50.3, x
- Fix · CNA WSO2 Carbon Registry Resources UI (WSO2) Fixed in 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.43.4, 4.8.50.1, 4.8.50.3, x
- Fix · CNA WSO2 Carbon Registry Search UI (WSO2) Fixed in 4.7.24.11, 4.7.32.16, 4.7.32.18, 4.7.33.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.9.16, 4.8.12.8, 4.8.13.9, 4.8.24.6, x
- Fix · CNA WSO2 Stratos User Interface For Tenant CRUD Operations (WSO2) Fixed in 4.8.1.6, 4.8.7.3, 4.9.8.7, 4.9.10.7, 4.9.10.8, 4.9.20.5, 4.9.27.1, 4.9.31.1, 4.9.34.1, 4.9.42.1, 4.11.0.7, 4.11.19.4, 4.11.34.3, 4.11.45.1, x
- Fix · CNA WSO2 Stratos SSO Redirector UI Component (WSO2) Fixed in 4.8.1.6, x
- Fix · CNA WSO2 Carbon Email Verification UI (WSO2) Fixed in 4.7.19.14, x
- Fix · CNA WSO2 Carbon Event Simulator UI (WSO2) Fixed in 2.2.11.1, 2.2.14.11, 2.2.14.12, 2.2.17.5, 2.3.1.4, 2.3.5.6, x
- Fix · CNA WSO2 Carbon Execution Manager UI (WSO2) Fixed in 5.2.24.10, 5.2.26.22, 5.2.34.12, 5.2.41.7, 5.2.57.10, 5.3.5.9, x
- Fix · CNA WSO2 Carbon Governance Custom Lifecycle Checklist UI (WSO2) Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, x
- Fix · CNA WSO2 Carbon Governance Generic Artifact User Interface (WSO2) Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, 4.8.33.4, 4.8.34.5, 4.8.37.4, x
- Fix · CNA WSO2 Carbon Governance Life Cycles User Interface (WSO2) Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, x
- Fix · CNA WSO2 Carbon Governance WSDL Tool UI (WSO2) Fixed in 4.8.14.4, 4.8.19.8, 4.8.21.10, 4.8.28.4, 4.8.30.6, 4.8.32.4, 4.8.33.4, 4.8.34.5, 4.8.37.4, x
- Fix · CNA WSO2 Carbon New Data Sources UI (WSO2) Fixed in 4.7.19.13, 4.7.24.5, 4.7.32.10, 4.7.35.13, 4.7.49.7, 4.7.52.5, 4.9.2.8, 4.9.11.2, 4.9.18.1, x
- Fix · CNA WSO2 Carbon Registry Info UI2 (WSO2) Fixed in 4.7.32.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.13.9, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.50.1, x
- Fix · CNA WSO2 Carbon Registry Relations UI (WSO2) Fixed in 4.7.24.11, 4.7.32.16, 4.7.35.15, 4.7.39.12, 4.7.51.8, 4.8.3.10, 4.8.13.9, 4.8.32.4, 4.8.36.2, 4.8.43.2, 4.8.50.1, x
- Fix · CNA WSO2 Carbon Registry Indexing (WSO2) Fixed in 4.7.24, x
- Fix · CNA WSO2 Carbon Security UI (WSO2) Fixed in 5.14.127, x
- Fix · CNA WSO2 Carbon Component Andes Event UI (WSO2) Fixed in 3.3.12.3, x
- Fix · CNA WSO2 Carbon Component Andes UI1 (WSO2) Fixed in 3.3.12.3, x
- Fix · CNA WSO2 Carbon HL7 Business Messaging Store UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Endpoint Editor UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Publish Event Mediator Configuration UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Eventing UI (WSO2) Fixed in 4.7.19.13, x
- Fix · CNA WSO2 Carbon HumanTask UI (WSO2) Fixed in 4.5.27.10, x
- Fix · CNA WSO2 Carbon Logging UI (WSO2) Fixed in 4.7.19.13, 4.7.24.5, 4.7.32.10, 4.7.52.5, x
- Fix · CNA WSO2 Carbon Template Editor UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Command Mediator UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Rule Mediator UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Throttle Mediator UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Tasks Core (WSO2) Fixed in 4.7.19.13, x
- Fix · CNA WSO2 Carbon Rest API Admin UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Sequence Editor UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Task UI (WSO2) Fixed in 4.7.30.53, x
- Fix · CNA WSO2 Carbon Governance (WSO2) Fixed in 4.8.37.4, x
Timeline
- 2026-10-02 Threatist record created from CVE-2025-13394
- 2026-10-03 Alias added: GHSA-8rr2-f52p-r9q3
References
More WSO2 Api Control Plane vulnerabilities
- TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
- TI-2025-13722 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products CVSS 3.1CRITICAL 9.4
- TI-2025-09712 Potential Broken Access Control in Multiple WSO2 Products via System REST APIs CVSS 3.1CRITICAL 9.8
- TI-2025-08391 Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint CVSS 3.1CRITICAL 9.8
- TI-2026-01411 Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover CVSS 3.1CRITICAL 9.8
- TI-2025-08536 Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-13394 · CVE Program
- CVE-2025-13394 · NVD
- FIRST EPSS
- GHSA-8rr2-f52p-r9q3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences