Search criteria

6 vulnerabilities found for enterprise_mobility_manager by wso2

FKIE_CVE-2025-9804

Vulnerability from fkie_nvd - Published: 2025-10-16 13:15 - Updated: 2025-11-21 21:40
Summary
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Impacted products
Vendor Product Version
wso2 api_control_plane 4.5.0
wso2 api_manager 2.0.0
wso2 api_manager 2.1.0
wso2 api_manager 2.2.0
wso2 api_manager 2.5.0
wso2 api_manager 2.6.0
wso2 api_manager 3.0.0
wso2 api_manager 3.1.0
wso2 api_manager 3.2.0
wso2 api_manager 3.2.1
wso2 api_manager 4.0.0
wso2 api_manager 4.1.0
wso2 api_manager 4.2.0
wso2 api_manager 4.3.0
wso2 api_manager 4.4.0
wso2 api_manager 4.5.0
wso2 api_manager_analytics 2.0.0
wso2 api_manager_analytics 2.1.0
wso2 api_manager_analytics 2.2.0
wso2 api_manager_analytics 2.5.0
wso2 data_analytics_server 3.1.0
wso2 data_analytics_server 3.2.0
wso2 enterprise_integrator 6.2.0
wso2 enterprise_integrator 6.3.0
wso2 enterprise_mobility_manager 2.2.0
wso2 enterprise_service_bus 5.0.0
wso2 identity_server 5.2.0
wso2 identity_server 5.3.0
wso2 identity_server 5.4.0
wso2 identity_server 5.4.1
wso2 identity_server 5.5.0
wso2 identity_server 5.6.0
wso2 identity_server 5.7.0
wso2 identity_server 5.8.0
wso2 identity_server 5.9.0
wso2 identity_server 5.10.0
wso2 identity_server 5.11.0
wso2 identity_server 6.0.0
wso2 identity_server 6.1.0
wso2 identity_server 7.0.0
wso2 identity_server 7.1.0
wso2 identity_server_analytics 5.2.0
wso2 identity_server_analytics 5.3.0
wso2 identity_server_analytics 5.5.0
wso2 identity_server_analytics 5.6.0
wso2 identity_server_as_key_manager 5.3.0
wso2 identity_server_as_key_manager 5.5.0
wso2 identity_server_as_key_manager 5.6.0
wso2 identity_server_as_key_manager 5.7.0
wso2 identity_server_as_key_manager 5.9.0
wso2 identity_server_as_key_manager 5.10.0
wso2 open_banking_am 1.4.0
wso2 open_banking_am 1.5.0
wso2 open_banking_am 2.0.0
wso2 open_banking_iam 2.0.0
wso2 open_banking_km 1.4.0
wso2 open_banking_km 1.5.0
wso2 traffic_manager 4.5.0
wso2 universal_gateway 4.5.0

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6D7E912-B0C4-4AD2-90CF-6355BA9DEEB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "245D4EB1-F69D-4FAF-94DB-F4B3D3C20539",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6819491F-C6C3-41C1-B27A-0D0B62224977",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D57C8CF-084D-4142-9AF1-7C9F1261A3BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC168B6A-B15A-4C3B-A38D-C0B65F24F333",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8FF14774-8935-4FC9-B5C8-9771B3D6EBFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2318B757-4BE3-4A45-9337-12281210964E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D5DF76F-1578-4C10-AB38-A01979302B3B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADEAF56C-4583-40A6-826F-01AC86191AD7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "04A2A50A-872E-4CC7-BBB7-3E0956176AAC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "941D83A5-1978-49AE-890D-E31980E2D6AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:data_analytics_server:3.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5CCDDFAB-C8FC-41C4-9872-667C442F119B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "66292C25-B0B9-4FCE-9382-57B8F6BB814A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "709DC7EA-18A6-4B83-84CB-F2499BEB5D2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:enterprise_mobility_manager:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9D6FCEF-7685-42DD-B322-AD87B5F37574",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "236C44E3-FAB5-41F2-9884-D17944EBB468",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2689AF3E-01AA-4B79-BA55-6BB3D81E16CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0375C318-ECD2-4657-A0D7-4A0708266FBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "B9E7D773-A7CE-4AB8-828B-C2E7DC2799AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "CEA63B98-D4B4-4FCD-A869-FE64BC21A1B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DA0050E-D5DD-45E5-9F61-DC1BB060EFF0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "26542F95-73F3-4906-838E-A66F5DC9DFA5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "60781FE4-38A3-4FEA-9D8B-CADE4B535974",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2B169832-A746-49A6-8E92-06624AA9B13A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "981D701D-E381-484A-9614-CD0EF0331071",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "EA76533A-5BED-4BDC-B348-EB3D3FDFB110",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "C1EFBD0F-9664-4EF3-9908-C72B1318F68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "A5358E6E-8C01-408D-8692-B1A326DC630F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_analytics:5.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1116722-BC4A-4127-9BF5-DB62760BD026",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_analytics:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D1AB6D32-5BD3-47F0-BDA8-3AEC1C24543F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_analytics:5.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "42BFE7A0-A168-4C1E-8725-41DD500C837E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_analytics:5.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5508EC5E-BEEA-49A7-BA2E-AEF40ECCB5C8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "104DBA04-538E-4CC5-9B6C-CFEDB40375AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4F0F121-700C-4D30-BAFC-960DCC56F08B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E5761F7-C287-4EC4-A899-C54FB4E80A35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B184BFC-8E1A-4971-B6D2-C594742AB8CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA51AC1B-0BF6-44F6-B034-CAD4F623DD76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CFB56F4-91D1-4FBF-842A-04BB117CAF85",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "035BF3B3-1AB9-43BC-BB37-68843818EDEA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E53783F4-60C7-4A92-8951-F8FD51170670",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "535EFD44-F81C-43B2-B595-81429468637F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7413107-D7B2-49AE-AC46-52E7BFCD6ED8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "61636553-C25E-44DF-93D7-EB3E1056D1DC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected."
    }
  ],
  "id": "CVE-2025-9804",
  "lastModified": "2025-11-21T21:40:09.890",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0,
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2025-10-16T13:15:42.130",
  "references": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2017-14651

Vulnerability from fkie_nvd - Published: 2017-09-21 18:29 - Updated: 2025-04-20 01:37
Summary
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "245D4EB1-F69D-4FAF-94DB-F4B3D3C20539",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:app_manager:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD697F16-E1A2-4320-A76E-794B05D3620B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:application_server:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8891BAB1-C357-4BC7-8B7A-541B9698F0A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:business_process_server:3.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E1F3AA02-B597-4C9F-936A-A4DC91F590B9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:business_rules_server:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5435A911-096A-4DEE-9E04-1D3CBF4D98D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:complex_event_processor:4.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "397D6C9B-62A5-42FC-AB3B-C03598C25A7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:dashboard_server:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AF5FB891-085E-4777-B771-1CDC367B8848",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:data_analytics_server:3.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "941D83A5-1978-49AE-890D-E31980E2D6AA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:data_services_server:3.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DEC72298-39AC-450F-8419-951057332163",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA3B48BB-ECB5-4A94-B76D-97BC3D303E9E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:enterprise_mobility_manager:2.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9D6FCEF-7685-42DD-B322-AD87B5F37574",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:governance_registry:5.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7B815FD-E12D-46CE-94B3-06ED2C75285D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0375C318-ECD2-4657-A0D7-4A0708266FBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:iot_server:3.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "00E81462-A034-4540-A086-7D836C6B17E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:machine_learner:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE333EE1-8158-40AF-8367-ACDCAA498516",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:message_broker:3.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8E3ADAB-067C-4D18-BDCA-43DDC607E4BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:storage_server:1.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0036440-3C00-4776-8DF6-AC30256EADBD",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter."
    },
    {
      "lang": "es",
      "value": "WSO2 Data Analytics Server 3.1.0 tiene una vulnerabilidad de tipo Cross-Site Scripting (XSS) en carbon/resources/add_collection_ajaxprocessor.jsp mediante los par\u00e1metros collectionName o parentPath."
    }
  ],
  "id": "CVE-2017-14651",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-09-21T18:29:00.167",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Technical Description",
        "Third Party Advisory"
      ],
      "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2025-9804 (GCVE-0-2025-9804)

Vulnerability from cvelistv5 – Published: 2025-10-16 12:33 – Updated: 2025-10-17 16:01
VLAI?
Summary
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
WSO2 WSO2 Identity Server as Key Manager Unknown: 0 , < 5.3.0 (custom)
Affected: 5.3.0 , < 5.3.0.41 (custom)
Affected: 5.5.0 , < 5.5.0.53 (custom)
Affected: 5.6.0 , < 5.6.0.75 (custom)
Affected: 5.7.0 , < 5.7.0.125 (custom)
Affected: 5.9.0 , < 5.9.0.176 (custom)
Affected: 5.10.0 , < 5.10.0.359 (custom)
Create a notification for this product.
    WSO2 WSO2 Identity Server Unknown: 0 , < 5.2.0 (custom)
Affected: 5.2.0 , < 5.2.0.34 (custom)
Affected: 5.3.0 , < 5.3.0.36 (custom)
Affected: 5.4.0 , < 5.4.0.34 (custom)
Affected: 5.4.1 , < 5.4.1.38 (custom)
Affected: 5.5.0 , < 5.5.0.52 (custom)
Affected: 5.6.0 , < 5.6.0.60 (custom)
Affected: 5.7.0 , < 5.7.0.126 (custom)
Affected: 5.8.0 , < 5.8.0.110 (custom)
Affected: 5.9.0 , < 5.9.0.169 (custom)
Affected: 5.10.0 , < 5.10.0.369 (custom)
Affected: 5.11.0 , < 5.11.0.413 (custom)
Affected: 6.0.0 , < 6.0.0.244 (custom)
Affected: 6.1.0 , < 6.1.0.243 (custom)
Affected: 7.0.0 , < 7.0.0.118 (custom)
Affected: 7.1.0 , < 7.1.0.25 (custom)
Create a notification for this product.
    WSO2 WSO2 Open Banking KM Unknown: 0 , < 1.4.0 (custom)
Affected: 1.4.0 , < 1.4.0.133 (custom)
Affected: 1.5.0 , < 1.5.0.123 (custom)
Create a notification for this product.
    WSO2 WSO2 Open Banking IAM Unknown: 0 , < 2.0.0 (custom)
Affected: 2.0.0 , < 2.0.0.409 (custom)
Create a notification for this product.
    WSO2 WSO2 Open Banking AM Unknown: 0 , < 1.4.0 (custom)
Affected: 1.4.0 , < 1.4.0.139 (custom)
Affected: 1.5.0 , < 1.5.0.140 (custom)
Affected: 2.0.0 , < 2.0.0.389 (custom)
Create a notification for this product.
    WSO2 WSO2 API Manager Unknown: 0 , < 2.0.0 (custom)
Affected: 2.0.0 , < 2.0.0.31 (custom)
Affected: 2.1.0 , < 2.1.0.40 (custom)
Affected: 2.2.0 , < 2.2.0.59 (custom)
Affected: 2.5.0 , < 2.5.0.85 (custom)
Affected: 2.6.0 , < 2.6.0.146 (custom)
Affected: 3.0.0 , < 3.0.0.176 (custom)
Affected: 3.1.0 , < 3.1.0.340 (custom)
Affected: 3.2.0 , < 3.2.0.441 (custom)
Affected: 3.2.1 , < 3.2.1.61 (custom)
Affected: 4.0.0 , < 4.0.0.361 (custom)
Affected: 4.1.0 , < 4.1.0.224 (custom)
Affected: 4.2.0 , < 4.2.0.162 (custom)
Affected: 4.3.0 , < 4.3.0.75 (custom)
Affected: 4.4.0 , < 4.4.0.39 (custom)
Affected: 4.5.0 , < 4.5.0.23 (custom)
Create a notification for this product.
    WSO2 WSO2 Identity Server Analytics Unknown: 0 , < 5.2.0 (custom)
Affected: 5.2.0 , < 5.2.0.19 (custom)
Affected: 5.3.0 , < 5.3.0.17 (custom)
Affected: 5.5.0 , < 5.5.0.31 (custom)
Affected: 5.6.0 , < 5.6.0.38 (custom)
Create a notification for this product.
    WSO2 API Manager Analytics Unknown: 0 , < 2.0.0 (custom)
Affected: 2.0.0 , < 2.0.0.14 (custom)
Affected: 2.1.0 , < 2.1.0.19 (custom)
Affected: 2.2.0 , < 2.2.0.30 (custom)
Affected: 2.5.0 , < 2.5.0.39 (custom)
Create a notification for this product.
    WSO2 WSO2 Enterprise Integrator Unknown: 0 , < 6.2.0 (custom)
Affected: 6.2.0 , < 6.2.0.62 (custom)
Affected: 6.3.0 , < 6.3.0.70 (custom)
Create a notification for this product.
    WSO2 WSO2 Enterprise Service Bus Analytics Unknown: 0 , < 5.0.0 (custom)
Affected: 5.0.0 , < 5.0.0.13 (custom)
Create a notification for this product.
    WSO2 WSO2 Data Analytics Server Unknown: 0 , < 3.1.0 (custom)
Affected: 3.1.0 , < 3.1.0.20 (custom)
Affected: 3.2.0 , < 3.2.0.33 (custom)
Create a notification for this product.
    WSO2 WSO2 Enterprise Mobility Manager Unknown: 0 , < 2.2.0 (custom)
Affected: 2.2.0 , < 2.2.0.28 (custom)
Create a notification for this product.
    WSO2 WSO2 Universal Gateway Affected: 4.5.0 , < 4.5.0.22 (custom)
Create a notification for this product.
    WSO2 WSO2 API Control Plane Affected: 4.5.0 , < 4.5.0.24 (custom)
Create a notification for this product.
    WSO2 WSO2 Traffic Manager Affected: 4.5.0 , < 4.5.0.22 (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector Affected: 2.0.10 , < 2.0.10.1 (custom)
Affected: 2.0.15 , < 2.0.15.1 (custom)
Affected: 2.0.21 , < 2.0.21.1 (custom)
Affected: 2.0.22 , < 2.0.22.1 (custom)
Affected: 2.1.12 , < 2.1.12.1 (custom)
Affected: 2.1 , < 2.1.1972 (custom)
Affected: 2.2 , < 2.2.24 (custom)
Affected: 2.2 , < 2.2.25 (custom)
Affected: 3.1.0 , < 3.1.0.74 (custom)
Affected: 3.3.6 , < 3.3.6.7 (custom)
Affected: 3.3.26 , < 3.3.26.2 (custom)
Affected: 3.3.35 , < 3.3.35.1 (custom)
Unaffected: 3.3.41 , ≤ * (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util Affected: 6.7.206 , < 6.7.206.567 (custom)
Affected: 6.7.210 , < 6.7.210.63 (custom)
Affected: 9.0.174 , < 9.0.174.522 (custom)
Affected: 9.20.74 , < 9.20.74.379 (custom)
Affected: 9.28.116 , < 9.28.116.360 (custom)
Affected: 9.29.120 , < 9.29.120.184 (custom)
Affected: 9.30.67 , < 9.30.67.109 (custom)
Affected: 9.31.86 , < 9.31.86.71 (custom)
Unaffected: 9.32.133 , ≤ * (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon:org.wso2.carbon.base Affected: 4.4.7 , < 4.4.7.6 (custom)
Affected: 4.4.9 , < 4.4.9.11 (custom)
Affected: 4.4.11 , < 4.4.11.9 (custom)
Affected: 4.4.26 , < 4.4.26.12 (custom)
Affected: 4.4.35 , < 4.4.35.44 (custom)
Affected: 4.5.1 , < 4.5.1.43 (custom)
Affected: 4.6.0 , < 4.6.0.1990 (custom)
Affected: 4.6.1 , < 4.6.1.149 (custom)
Affected: 4.6.2 , < 4.6.2.667 (custom)
Affected: 4.6.3 , < 4.6.3.36 (custom)
Affected: 4.6.4 , < 4.6.4.14 (custom)
Affected: 4.7.1 , < 4.7.1.68 (custom)
Affected: 4.8.1 , < 4.8.1.39 (custom)
Affected: 4.9.0 , < 4.9.0.99 (custom)
Affected: 4.9.26 , < 4.9.26.25 (custom)
Affected: 4.9.27 , < 4.9.27.10 (custom)
Affected: 4.9.28 , < 4.9.28.11 (custom)
Affected: 4.10.9 , < 4.10.9.66 (custom)
Affected: 4.10.42 , < 4.10.42.9 (custom)
Affected: 4.9 , < 4.9.29 (custom)
Affected: 4.10 , < 4.10.94 (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt Affected: 5.2.0 , < 5.2.0.4 (custom)
Affected: 5.2.2 , < 5.2.2.21 (custom)
Affected: 5.7.5 , < 5.7.5.18 (custom)
Affected: 5.11.148 , < 5.11.148.19 (custom)
Affected: 5.11.256 , < 5.11.256.21 (custom)
Affected: 5.12.153 , < 5.12.153.63 (custom)
Affected: 5.12.387 , < 5.12.387.46 (custom)
Affected: 5.14.97 , < 5.14.97.89 (custom)
Affected: 5.17.5 , < 5.17.5.317 (custom)
Affected: 5.17.118 , < 5.17.118.17 (custom)
Affected: 5.18.187 , < 5.18.187.309 (custom)
Affected: 5.18.248 , < 5.18.248.30 (custom)
Affected: 5.23.8 , < 5.23.8.207 (custom)
Affected: 5.24.8 , < 5.24.8.23 (custom)
Affected: 5.25.92 , < 5.25.92.152 (custom)
Affected: 5.25.705 , < 5.25.705.19 (custom)
Affected: 5.25.713 , < 5.25.713.9 (custom)
Affected: 5.25.724 , < 5.25.724.3 (custom)
Affected: 7.0.78 , < 7.0.78.133 (custom)
Affected: 7.8.23 , < 7.8.23.47 (custom)
Affected: 5.25 , < 5.25.734 (custom)
Unaffected: 7.8.489 , ≤ * (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon:org.wso2.carbon.server.admin Affected: 4.4.7 , < 4.4.7.6 (custom)
Affected: 4.4.9 , < 4.4.9.11 (custom)
Affected: 4.4.11 , < 4.4.11.9 (custom)
Affected: 4.4.26 , < 4.4.26.12 (custom)
Affected: 4.4.32 , < 4.4.32.16 (custom)
Affected: 4.4.35 , < 4.4.35.44 (custom)
Affected: 4.5.1 , < 4.5.1.43 (custom)
Affected: 4.6.0 , < 4.6.0.1990 (custom)
Affected: 4.6.1 , < 4.6.1.149 (custom)
Affected: 4.6.2 , < 4.6.2.667 (custom)
Affected: 4.6.3 , < 4.6.3.36 (custom)
Affected: 4.6.4 , < 4.6.4.14 (custom)
Affected: 4.7.1 , < 4.7.1.68 (custom)
Affected: 4.8.1 , < 4.8.1.39 (custom)
Affected: 4.9.0 , < 4.9.0.99 (custom)
Affected: 4.9.26 , < 4.9.26.25 (custom)
Affected: 4.9.27 , < 4.9.27.10 (custom)
Affected: 4.9.28 , < 4.9.28.11 (custom)
Affected: 4.10.9 , < 4.10.9.66 (custom)
Affected: 4.10.42 , < 4.10.42.9 (custom)
Affected: 4.9 , < 4.9.29 (custom)
Affected: 4.10 , < 4.10.94 (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow Affected: 5.1.1 , < 5.1.1.1 (custom)
Affected: 5.1.2 , < 5.1.2.1 (custom)
Affected: 5.1.5 , < 5.1.5.1 (custom)
Affected: 5.3.3 , < 5.3.3.1 (custom)
Affected: 5.4.0 , < 5.4.0.4 (custom)
Affected: 5.4.1 , < 5.4.1.5 (custom)
Affected: 5.6.0 , < 5.6.0.1 (custom)
Unaffected: 5.6.21 , ≤ * (custom)
Create a notification for this product.
Credits
crnković
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T13:20:20.582589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-17T16:01:25.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.41",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.53",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.75",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.125",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.176",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.359",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.34",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.36",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.34",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.38",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.52",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.60",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.126",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.0.110",
              "status": "affected",
              "version": "5.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.169",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.369",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.413",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.244",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.243",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.118",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.25",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking KM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.133",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.123",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.409",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.139",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.140",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.389",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.31",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.40",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.59",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.85",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.6.0.146",
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.0.176",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.340",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.441",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.61",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.361",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.224",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.162",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.75",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.39",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.23",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.19",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.17",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.31",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.38",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "API Manager Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.14",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.19",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.30",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.39",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.0.62",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.0.70",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Service Bus Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.0.13",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Data Analytics Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.20",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.33",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Mobility Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.28",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.24",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "product": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.10.1",
              "status": "affected",
              "version": "2.0.10",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.15.1",
              "status": "affected",
              "version": "2.0.15",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.21.1",
              "status": "affected",
              "version": "2.0.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.22.1",
              "status": "affected",
              "version": "2.0.22",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.12.1",
              "status": "affected",
              "version": "2.1.12",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.1972",
              "status": "affected",
              "version": "2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.24",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.25",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.74",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.6.7",
              "status": "affected",
              "version": "3.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.26.2",
              "status": "affected",
              "version": "3.3.26",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.35.1",
              "status": "affected",
              "version": "3.3.35",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "3.3.41",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "product": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.7.206.567",
              "status": "affected",
              "version": "6.7.206",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.210.63",
              "status": "affected",
              "version": "6.7.210",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.174.522",
              "status": "affected",
              "version": "9.0.174",
              "versionType": "custom"
            },
            {
              "lessThan": "9.20.74.379",
              "status": "affected",
              "version": "9.20.74",
              "versionType": "custom"
            },
            {
              "lessThan": "9.28.116.360",
              "status": "affected",
              "version": "9.28.116",
              "versionType": "custom"
            },
            {
              "lessThan": "9.29.120.184",
              "status": "affected",
              "version": "9.29.120",
              "versionType": "custom"
            },
            {
              "lessThan": "9.30.67.109",
              "status": "affected",
              "version": "9.30.67",
              "versionType": "custom"
            },
            {
              "lessThan": "9.31.86.71",
              "status": "affected",
              "version": "9.31.86",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "9.32.133",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.base",
          "product": "org.wso2.carbon:org.wso2.carbon.base",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "product": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0.4",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.2.21",
              "status": "affected",
              "version": "5.2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.5.18",
              "status": "affected",
              "version": "5.7.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.148.19",
              "status": "affected",
              "version": "5.11.148",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.256.21",
              "status": "affected",
              "version": "5.11.256",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.153.63",
              "status": "affected",
              "version": "5.12.153",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.387.46",
              "status": "affected",
              "version": "5.12.387",
              "versionType": "custom"
            },
            {
              "lessThan": "5.14.97.89",
              "status": "affected",
              "version": "5.14.97",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.317",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.17",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.309",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.30",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.207",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.23",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.152",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.19",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.9",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.3",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.133",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.47",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.734",
              "status": "affected",
              "version": "5.25",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.8.489",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "product": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.32.16",
              "status": "affected",
              "version": "4.4.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "product": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.1.1.1",
              "status": "affected",
              "version": "5.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.2.1",
              "status": "affected",
              "version": "5.1.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.5.1",
              "status": "affected",
              "version": "5.1.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.3.1",
              "status": "affected",
              "version": "5.3.3",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.4",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.5",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.1",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.6.21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "crnkovi\u0107"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\u003cbr\u003e\u003cbr\u003eThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected.\u003cbr\u003e"
            }
          ],
          "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 API Manager"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 Identity Server"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T12:33:45.426Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2025-4503",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2025-9804",
    "datePublished": "2025-10-16T12:33:45.426Z",
    "dateReserved": "2025-09-01T13:11:12.678Z",
    "dateUpdated": "2025-10-17T16:01:25.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-14651 (GCVE-0-2017-14651)

Vulnerability from cvelistv5 – Published: 2017-09-21 18:00 – Updated: 2024-08-05 19:34
VLAI?
Summary
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:34:39.735Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-09-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-29T20:58:38",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14651",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/cybersecurityworks/Disclosed/issues/15",
              "refsource": "MISC",
              "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
            },
            {
              "name": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265",
              "refsource": "MISC",
              "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
            },
            {
              "name": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html",
              "refsource": "MISC",
              "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14651",
    "datePublished": "2017-09-21T18:00:00",
    "dateReserved": "2017-09-21T00:00:00",
    "dateUpdated": "2024-08-05T19:34:39.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-9804 (GCVE-0-2025-9804)

Vulnerability from nvd – Published: 2025-10-16 12:33 – Updated: 2025-10-17 16:01
VLAI?
Summary
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
CWE
  • CWE-284 - Improper Access Control
Assigner
References
Impacted products
Vendor Product Version
WSO2 WSO2 Identity Server as Key Manager Unknown: 0 , < 5.3.0 (custom)
Affected: 5.3.0 , < 5.3.0.41 (custom)
Affected: 5.5.0 , < 5.5.0.53 (custom)
Affected: 5.6.0 , < 5.6.0.75 (custom)
Affected: 5.7.0 , < 5.7.0.125 (custom)
Affected: 5.9.0 , < 5.9.0.176 (custom)
Affected: 5.10.0 , < 5.10.0.359 (custom)
Create a notification for this product.
    WSO2 WSO2 Identity Server Unknown: 0 , < 5.2.0 (custom)
Affected: 5.2.0 , < 5.2.0.34 (custom)
Affected: 5.3.0 , < 5.3.0.36 (custom)
Affected: 5.4.0 , < 5.4.0.34 (custom)
Affected: 5.4.1 , < 5.4.1.38 (custom)
Affected: 5.5.0 , < 5.5.0.52 (custom)
Affected: 5.6.0 , < 5.6.0.60 (custom)
Affected: 5.7.0 , < 5.7.0.126 (custom)
Affected: 5.8.0 , < 5.8.0.110 (custom)
Affected: 5.9.0 , < 5.9.0.169 (custom)
Affected: 5.10.0 , < 5.10.0.369 (custom)
Affected: 5.11.0 , < 5.11.0.413 (custom)
Affected: 6.0.0 , < 6.0.0.244 (custom)
Affected: 6.1.0 , < 6.1.0.243 (custom)
Affected: 7.0.0 , < 7.0.0.118 (custom)
Affected: 7.1.0 , < 7.1.0.25 (custom)
Create a notification for this product.
    WSO2 WSO2 Open Banking KM Unknown: 0 , < 1.4.0 (custom)
Affected: 1.4.0 , < 1.4.0.133 (custom)
Affected: 1.5.0 , < 1.5.0.123 (custom)
Create a notification for this product.
    WSO2 WSO2 Open Banking IAM Unknown: 0 , < 2.0.0 (custom)
Affected: 2.0.0 , < 2.0.0.409 (custom)
Create a notification for this product.
    WSO2 WSO2 Open Banking AM Unknown: 0 , < 1.4.0 (custom)
Affected: 1.4.0 , < 1.4.0.139 (custom)
Affected: 1.5.0 , < 1.5.0.140 (custom)
Affected: 2.0.0 , < 2.0.0.389 (custom)
Create a notification for this product.
    WSO2 WSO2 API Manager Unknown: 0 , < 2.0.0 (custom)
Affected: 2.0.0 , < 2.0.0.31 (custom)
Affected: 2.1.0 , < 2.1.0.40 (custom)
Affected: 2.2.0 , < 2.2.0.59 (custom)
Affected: 2.5.0 , < 2.5.0.85 (custom)
Affected: 2.6.0 , < 2.6.0.146 (custom)
Affected: 3.0.0 , < 3.0.0.176 (custom)
Affected: 3.1.0 , < 3.1.0.340 (custom)
Affected: 3.2.0 , < 3.2.0.441 (custom)
Affected: 3.2.1 , < 3.2.1.61 (custom)
Affected: 4.0.0 , < 4.0.0.361 (custom)
Affected: 4.1.0 , < 4.1.0.224 (custom)
Affected: 4.2.0 , < 4.2.0.162 (custom)
Affected: 4.3.0 , < 4.3.0.75 (custom)
Affected: 4.4.0 , < 4.4.0.39 (custom)
Affected: 4.5.0 , < 4.5.0.23 (custom)
Create a notification for this product.
    WSO2 WSO2 Identity Server Analytics Unknown: 0 , < 5.2.0 (custom)
Affected: 5.2.0 , < 5.2.0.19 (custom)
Affected: 5.3.0 , < 5.3.0.17 (custom)
Affected: 5.5.0 , < 5.5.0.31 (custom)
Affected: 5.6.0 , < 5.6.0.38 (custom)
Create a notification for this product.
    WSO2 API Manager Analytics Unknown: 0 , < 2.0.0 (custom)
Affected: 2.0.0 , < 2.0.0.14 (custom)
Affected: 2.1.0 , < 2.1.0.19 (custom)
Affected: 2.2.0 , < 2.2.0.30 (custom)
Affected: 2.5.0 , < 2.5.0.39 (custom)
Create a notification for this product.
    WSO2 WSO2 Enterprise Integrator Unknown: 0 , < 6.2.0 (custom)
Affected: 6.2.0 , < 6.2.0.62 (custom)
Affected: 6.3.0 , < 6.3.0.70 (custom)
Create a notification for this product.
    WSO2 WSO2 Enterprise Service Bus Analytics Unknown: 0 , < 5.0.0 (custom)
Affected: 5.0.0 , < 5.0.0.13 (custom)
Create a notification for this product.
    WSO2 WSO2 Data Analytics Server Unknown: 0 , < 3.1.0 (custom)
Affected: 3.1.0 , < 3.1.0.20 (custom)
Affected: 3.2.0 , < 3.2.0.33 (custom)
Create a notification for this product.
    WSO2 WSO2 Enterprise Mobility Manager Unknown: 0 , < 2.2.0 (custom)
Affected: 2.2.0 , < 2.2.0.28 (custom)
Create a notification for this product.
    WSO2 WSO2 Universal Gateway Affected: 4.5.0 , < 4.5.0.22 (custom)
Create a notification for this product.
    WSO2 WSO2 API Control Plane Affected: 4.5.0 , < 4.5.0.24 (custom)
Create a notification for this product.
    WSO2 WSO2 Traffic Manager Affected: 4.5.0 , < 4.5.0.22 (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector Affected: 2.0.10 , < 2.0.10.1 (custom)
Affected: 2.0.15 , < 2.0.15.1 (custom)
Affected: 2.0.21 , < 2.0.21.1 (custom)
Affected: 2.0.22 , < 2.0.22.1 (custom)
Affected: 2.1.12 , < 2.1.12.1 (custom)
Affected: 2.1 , < 2.1.1972 (custom)
Affected: 2.2 , < 2.2.24 (custom)
Affected: 2.2 , < 2.2.25 (custom)
Affected: 3.1.0 , < 3.1.0.74 (custom)
Affected: 3.3.6 , < 3.3.6.7 (custom)
Affected: 3.3.26 , < 3.3.26.2 (custom)
Affected: 3.3.35 , < 3.3.35.1 (custom)
Unaffected: 3.3.41 , ≤ * (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util Affected: 6.7.206 , < 6.7.206.567 (custom)
Affected: 6.7.210 , < 6.7.210.63 (custom)
Affected: 9.0.174 , < 9.0.174.522 (custom)
Affected: 9.20.74 , < 9.20.74.379 (custom)
Affected: 9.28.116 , < 9.28.116.360 (custom)
Affected: 9.29.120 , < 9.29.120.184 (custom)
Affected: 9.30.67 , < 9.30.67.109 (custom)
Affected: 9.31.86 , < 9.31.86.71 (custom)
Unaffected: 9.32.133 , ≤ * (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon:org.wso2.carbon.base Affected: 4.4.7 , < 4.4.7.6 (custom)
Affected: 4.4.9 , < 4.4.9.11 (custom)
Affected: 4.4.11 , < 4.4.11.9 (custom)
Affected: 4.4.26 , < 4.4.26.12 (custom)
Affected: 4.4.35 , < 4.4.35.44 (custom)
Affected: 4.5.1 , < 4.5.1.43 (custom)
Affected: 4.6.0 , < 4.6.0.1990 (custom)
Affected: 4.6.1 , < 4.6.1.149 (custom)
Affected: 4.6.2 , < 4.6.2.667 (custom)
Affected: 4.6.3 , < 4.6.3.36 (custom)
Affected: 4.6.4 , < 4.6.4.14 (custom)
Affected: 4.7.1 , < 4.7.1.68 (custom)
Affected: 4.8.1 , < 4.8.1.39 (custom)
Affected: 4.9.0 , < 4.9.0.99 (custom)
Affected: 4.9.26 , < 4.9.26.25 (custom)
Affected: 4.9.27 , < 4.9.27.10 (custom)
Affected: 4.9.28 , < 4.9.28.11 (custom)
Affected: 4.10.9 , < 4.10.9.66 (custom)
Affected: 4.10.42 , < 4.10.42.9 (custom)
Affected: 4.9 , < 4.9.29 (custom)
Affected: 4.10 , < 4.10.94 (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt Affected: 5.2.0 , < 5.2.0.4 (custom)
Affected: 5.2.2 , < 5.2.2.21 (custom)
Affected: 5.7.5 , < 5.7.5.18 (custom)
Affected: 5.11.148 , < 5.11.148.19 (custom)
Affected: 5.11.256 , < 5.11.256.21 (custom)
Affected: 5.12.153 , < 5.12.153.63 (custom)
Affected: 5.12.387 , < 5.12.387.46 (custom)
Affected: 5.14.97 , < 5.14.97.89 (custom)
Affected: 5.17.5 , < 5.17.5.317 (custom)
Affected: 5.17.118 , < 5.17.118.17 (custom)
Affected: 5.18.187 , < 5.18.187.309 (custom)
Affected: 5.18.248 , < 5.18.248.30 (custom)
Affected: 5.23.8 , < 5.23.8.207 (custom)
Affected: 5.24.8 , < 5.24.8.23 (custom)
Affected: 5.25.92 , < 5.25.92.152 (custom)
Affected: 5.25.705 , < 5.25.705.19 (custom)
Affected: 5.25.713 , < 5.25.713.9 (custom)
Affected: 5.25.724 , < 5.25.724.3 (custom)
Affected: 7.0.78 , < 7.0.78.133 (custom)
Affected: 7.8.23 , < 7.8.23.47 (custom)
Affected: 5.25 , < 5.25.734 (custom)
Unaffected: 7.8.489 , ≤ * (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon:org.wso2.carbon.server.admin Affected: 4.4.7 , < 4.4.7.6 (custom)
Affected: 4.4.9 , < 4.4.9.11 (custom)
Affected: 4.4.11 , < 4.4.11.9 (custom)
Affected: 4.4.26 , < 4.4.26.12 (custom)
Affected: 4.4.32 , < 4.4.32.16 (custom)
Affected: 4.4.35 , < 4.4.35.44 (custom)
Affected: 4.5.1 , < 4.5.1.43 (custom)
Affected: 4.6.0 , < 4.6.0.1990 (custom)
Affected: 4.6.1 , < 4.6.1.149 (custom)
Affected: 4.6.2 , < 4.6.2.667 (custom)
Affected: 4.6.3 , < 4.6.3.36 (custom)
Affected: 4.6.4 , < 4.6.4.14 (custom)
Affected: 4.7.1 , < 4.7.1.68 (custom)
Affected: 4.8.1 , < 4.8.1.39 (custom)
Affected: 4.9.0 , < 4.9.0.99 (custom)
Affected: 4.9.26 , < 4.9.26.25 (custom)
Affected: 4.9.27 , < 4.9.27.10 (custom)
Affected: 4.9.28 , < 4.9.28.11 (custom)
Affected: 4.10.9 , < 4.10.9.66 (custom)
Affected: 4.10.42 , < 4.10.42.9 (custom)
Affected: 4.9 , < 4.9.29 (custom)
Affected: 4.10 , < 4.10.94 (custom)
Create a notification for this product.
    WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow Affected: 5.1.1 , < 5.1.1.1 (custom)
Affected: 5.1.2 , < 5.1.2.1 (custom)
Affected: 5.1.5 , < 5.1.5.1 (custom)
Affected: 5.3.3 , < 5.3.3.1 (custom)
Affected: 5.4.0 , < 5.4.0.4 (custom)
Affected: 5.4.1 , < 5.4.1.5 (custom)
Affected: 5.6.0 , < 5.6.0.1 (custom)
Unaffected: 5.6.21 , ≤ * (custom)
Create a notification for this product.
Credits
crnković
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T13:20:20.582589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-17T16:01:25.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.41",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.53",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.75",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.125",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.176",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.359",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.34",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.36",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.34",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.38",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.52",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.60",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.126",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.0.110",
              "status": "affected",
              "version": "5.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.169",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.369",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.413",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.244",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.243",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.118",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.25",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking KM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.133",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.123",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.409",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.139",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.140",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.389",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.31",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.40",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.59",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.85",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.6.0.146",
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.0.176",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.340",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.441",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.61",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.361",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.224",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.162",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.75",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.39",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.23",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.19",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.17",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.31",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.38",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "API Manager Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.14",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.19",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.30",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.39",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.0.62",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.0.70",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Service Bus Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.0.13",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Data Analytics Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.20",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.33",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Mobility Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.28",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.24",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "product": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.10.1",
              "status": "affected",
              "version": "2.0.10",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.15.1",
              "status": "affected",
              "version": "2.0.15",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.21.1",
              "status": "affected",
              "version": "2.0.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.22.1",
              "status": "affected",
              "version": "2.0.22",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.12.1",
              "status": "affected",
              "version": "2.1.12",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.1972",
              "status": "affected",
              "version": "2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.24",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.25",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.74",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.6.7",
              "status": "affected",
              "version": "3.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.26.2",
              "status": "affected",
              "version": "3.3.26",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.35.1",
              "status": "affected",
              "version": "3.3.35",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "3.3.41",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "product": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.7.206.567",
              "status": "affected",
              "version": "6.7.206",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.210.63",
              "status": "affected",
              "version": "6.7.210",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.174.522",
              "status": "affected",
              "version": "9.0.174",
              "versionType": "custom"
            },
            {
              "lessThan": "9.20.74.379",
              "status": "affected",
              "version": "9.20.74",
              "versionType": "custom"
            },
            {
              "lessThan": "9.28.116.360",
              "status": "affected",
              "version": "9.28.116",
              "versionType": "custom"
            },
            {
              "lessThan": "9.29.120.184",
              "status": "affected",
              "version": "9.29.120",
              "versionType": "custom"
            },
            {
              "lessThan": "9.30.67.109",
              "status": "affected",
              "version": "9.30.67",
              "versionType": "custom"
            },
            {
              "lessThan": "9.31.86.71",
              "status": "affected",
              "version": "9.31.86",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "9.32.133",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.base",
          "product": "org.wso2.carbon:org.wso2.carbon.base",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "product": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0.4",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.2.21",
              "status": "affected",
              "version": "5.2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.5.18",
              "status": "affected",
              "version": "5.7.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.148.19",
              "status": "affected",
              "version": "5.11.148",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.256.21",
              "status": "affected",
              "version": "5.11.256",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.153.63",
              "status": "affected",
              "version": "5.12.153",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.387.46",
              "status": "affected",
              "version": "5.12.387",
              "versionType": "custom"
            },
            {
              "lessThan": "5.14.97.89",
              "status": "affected",
              "version": "5.14.97",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.317",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.17",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.309",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.30",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.207",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.23",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.152",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.19",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.9",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.3",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.133",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.47",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.734",
              "status": "affected",
              "version": "5.25",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.8.489",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "product": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.32.16",
              "status": "affected",
              "version": "4.4.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "product": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.1.1.1",
              "status": "affected",
              "version": "5.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.2.1",
              "status": "affected",
              "version": "5.1.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.5.1",
              "status": "affected",
              "version": "5.1.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.3.1",
              "status": "affected",
              "version": "5.3.3",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.4",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.5",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.1",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.6.21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "crnkovi\u0107"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\u003cbr\u003e\u003cbr\u003eThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected.\u003cbr\u003e"
            }
          ],
          "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 API Manager"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 Identity Server"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T12:33:45.426Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2025-4503",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2025-9804",
    "datePublished": "2025-10-16T12:33:45.426Z",
    "dateReserved": "2025-09-01T13:11:12.678Z",
    "dateUpdated": "2025-10-17T16:01:25.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-14651 (GCVE-0-2017-14651)

Vulnerability from nvd – Published: 2017-09-21 18:00 – Updated: 2024-08-05 19:34
VLAI?
Summary
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
Show details on NVD website

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T19:34:39.735Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-09-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-29T20:58:38",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-14651",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/cybersecurityworks/Disclosed/issues/15",
              "refsource": "MISC",
              "url": "https://github.com/cybersecurityworks/Disclosed/issues/15"
            },
            {
              "name": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265",
              "refsource": "MISC",
              "url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265"
            },
            {
              "name": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html",
              "refsource": "MISC",
              "url": "https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-14651",
    "datePublished": "2017-09-21T18:00:00",
    "dateReserved": "2017-09-21T00:00:00",
    "dateUpdated": "2024-08-05T19:34:39.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}