Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution (WSO2 WSO2 Open Banking AM)
En bref
- Source
- NVD
- EPSS
- EPSS 0.37 % · centile 31 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- WSO2
- Statut NVD
- Analyzed
Rechercher sur…
Description
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Faiblesses (CWE)
- CWE-78 — Injection de commande système
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | WSO2 |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-210842
- GCVE · GCVE-0-2025-12737
Configurations affectées (CPE NVD)
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.36cpe:2.3:a:wso2:api_control_plane:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.1.0.349cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.0.453cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.2.1 < 3.2.1.73cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.0.373cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.236cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.0.176cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.0.88cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.0.52cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.35cpe:2.3:a:wso2:api_manager:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.10.0 < 5.10.0.378cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.11.0 < 5.11.0.425cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.0.252cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.1.0.253cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.0.0.130cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 7.1.0 < 7.1.0.38cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*≥ 5.10.0 < 5.10.0.369cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.0.398cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.0.418cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.34cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.34cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| WSO2 · WSO2 Open Banking AM | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.398 |
| WSO2 · WSO2 Open Banking IAM | unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.418 |
| WSO2 · WSO2 Traffic Manager | affected 4.5.0 < 4.5.0.34 ; affected 4.6.0 < 4.6.0.1 |
| WSO2 · WSO2 Universal Gateway | affected 4.5.0 < 4.5.0.34 ; affected 4.6.0 < 4.6.0.1 |
| WSO2 · WSO2 API Control Plane | affected 4.5.0 < 4.5.0.36 ; affected 4.6.0 < 4.6.0.1 |
| WSO2 · WSO2 API Manager | unknown 0 < 3.1.0 ; affected 3.1.0 < 3.1.0.349 ; affected 3.2.0 < 3.2.0.453 ; affected 3.2.1 < 3.2.1.73 ; affected 4.0.0 < 4.0.0.373 ; affected 4.1.0 < 4.1.0.236 |
| WSO2 · WSO2 Identity Server as Key Manager | unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.369 |
| WSO2 · WSO2 Identity Server | unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.378 ; affected 5.11.0 < 5.11.0.425 ; affected 6.0.0 < 6.0.0.252 ; affected 6.1.0 < 6.1.0.253 ; affected 7.0.0 < 7.0.0.130 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |