CVE-2025-10907 (GCVE-0-2025-10907)
Vulnerability from cvelistv5 – Published: 2025-11-05 18:03 – Updated: 2025-11-05 18:49
VLAI
EPSS
VEX
Title
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
Summary
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.
Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-11-05 18:49 UTC
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
18 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.1.0
(custom)
Affected: 3.1.0 , < 3.1.0.345 (custom) Affected: 3.2.0 , < 3.2.0.448 (custom) Affected: 3.2.1 , < 3.2.1.66 (custom) Affected: 4.0.0 , < 4.0.0.367 (custom) Affected: 4.1.0 , < 4.1.0.230 (custom) Affected: 4.2.0 , < 4.2.0.169 (custom) Affected: 4.3.0 , < 4.3.0.81 (custom) Affected: 4.4.0 , < 4.4.0.45 (custom) Affected: 4.5.0 , < 4.5.0.28 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Open Banking IAM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.414 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Open Banking AM |
Unknown:
0 , < 2.0.0
(custom)
Affected: 2.0.0 , < 2.0.0.394 (custom) cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.29
(custom)
cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.27
(custom)
cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.27
(custom)
cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Micro Integrator |
Unknown:
0 , < 4.0.0
(custom)
Affected: 4.0.0 , < 4.0.0.145 (custom) Affected: 4.1.0 , < 4.1.0.147 (custom) Affected: 4.2.0 , < 4.2.0.141 (custom) cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Identity Server |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.375 (custom) Affected: 5.11.0 , < 5.11.0.419 (custom) Affected: 6.0.0 , < 6.0.0.248 (custom) Affected: 6.1.0 , < 6.1.0.248 (custom) Affected: 7.0.0 , < 7.0.0.124 (custom) Affected: 7.1.0 , < 7.1.0.31 (custom) cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Identity Server as Key Manager |
Unknown:
0 , < 5.10.0
(custom)
Affected: 5.10.0 , < 5.10.0.365 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:* |
||
| WSO2 | WSO2 Enterprise Integrator |
Unknown:
0 , < 6.6.0
(custom)
Affected: 6.6.0 , < 6.6.0.224 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:* |
||
| WSO2 | org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt |
Affected:
0.14.13 , < 0.14.13.8
(custom)
Affected: 0.14.16 , < 0.14.16.1 (custom) cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:* |
||
| WSO2 | org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core |
Affected:
2.2.14 , < 2.2.14.7
(custom)
Affected: 2.2.17 , < 2.2.17.2 (custom) Affected: 2.3.1 , < 2.3.1.3 (custom) Unaffected: 2.3.19 , ≤ * (custom) cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:* |
||
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library |
Affected:
4.7.30 , < 4.7.30.47
(custom)
Affected: 4.7.61 , < 4.7.61.62 (custom) Affected: 4.7.99 , < 4.7.99.304 (custom) Affected: 4.7.131 , < 4.7.131.22 (custom) Affected: 4.7.175 , < 4.7.175.30 (custom) Affected: 4.7.188 , < 4.7.188.12 (custom) Affected: 4.7.204 , < 4.7.204.13 (custom) Affected: 4.7.221 , < 4.7.221.7 (custom) Affected: 4.7.245 , < 4.7.245.7 (custom) Unaffected: 4.7.262 , ≤ * (custom) cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:* |
||
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt |
Affected:
4.9.15 , < 4.9.15.2
(custom)
Affected: 4.10.1 , < 4.10.1.1 (custom) Affected: 4.10.9 , < 4.10.9.2 (custom) Affected: 4.11.1 , < 4.11.1.3 (custom) Affected: 4.11.3 , < 4.11.3.3 (custom) Affected: 4.11.7 , < 4.11.7.5 (custom) Affected: 4.11.14 , < 4.11.14.2 (custom) Affected: 4.11.17 , < 4.11.17.3 (custom) Affected: 4.11.18 , < 4.11.18.1 (custom) Unaffected: 4.11.24 , ≤ * (custom) cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:* |
||
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt |
Affected:
4.10.1 , < 4.10.1.1
(custom)
Affected: 4.10.9 , < 4.10.9.2 (custom) Affected: 4.11.1 , < 4.11.1.3 (custom) Affected: 4.11.3 , < 4.11.3.3 (custom) Affected: 4.11.7 , < 4.11.7.5 (custom) Affected: 4.11.14 , < 4.11.14.2 (custom) Affected: 4.11.17 , < 4.11.17.3 (custom) Affected: 4.11.18 , < 4.11.18.1 (custom) Unaffected: 4.11.24 , ≤ * (custom) cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:* |
||
| WSO2 | org.apache.ws.commons.axiom.wso2:axiom |
Affected:
1.2.11 , < 1.2.11.wso2v17_5
(custom)
Unaffected: 1.2.11-wso2v21 , ≤ * (custom) cpe:2.3:a:wso2:org.apache.ws.commons.axiom.wso2_axiom:*:*:*:*:*:*:*:* |
||
| WSO2 | org.wso2.carbon:org.wso2.carbon.base |
Affected:
4.5.3 , < 4.5.3.46
(custom)
Affected: 4.6.0 , < 4.6.0.2005 (custom) Affected: 4.6.1 , < 4.6.1.153 (custom) Affected: 4.6.2 , < 4.6.2.668 (custom) Affected: 4.6.3 , < 4.6.3.37 (custom) Affected: 4.6.4 , < 4.6.4.15 (custom) Affected: 4.7.1 , < 4.7.1.72 (custom) Affected: 4.8.1 , < 4.8.1.40 (custom) Affected: 4.9.0 , < 4.9.0.103 (custom) Affected: 4.9.26 , < 4.9.26.26 (custom) Affected: 4.9.27 , < 4.9.27.11 (custom) Affected: 4.9.28 , < 4.9.28.12 (custom) Affected: 4.10.9 , < 4.10.9.71 (custom) Affected: 4.10.42 , < 4.10.42.14 (custom) Unaffected: 4.9.30 , ≤ 4.9.* (custom) Unaffected: 4.10.95 , ≤ * (custom) cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:* |
||
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils |
Affected:
4.5.3 , < 4.5.3.46
(custom)
Affected: 4.6.0 , < 4.6.0.2005 (custom) Affected: 4.6.1 , < 4.6.1.153 (custom) Affected: 4.6.2 , < 4.6.2.668 (custom) Affected: 4.6.3 , < 4.6.3.37 (custom) Affected: 4.6.4 , < 4.6.4.15 (custom) Affected: 4.7.1 , < 4.7.1.72 (custom) Affected: 4.8.1 , < 4.8.1.40 (custom) Affected: 4.9.0 , < 4.9.0.103 (custom) Affected: 4.9.26 , < 4.9.26.26 (custom) Affected: 4.9.27 , < 4.9.27.11 (custom) Affected: 4.9.28 , < 4.9.28.12 (custom) Affected: 4.10.9 , < 4.10.9.71 (custom) Affected: 4.10.42 , < 4.10.42.14 (custom) Unaffected: 4.9.30 , ≤ 4.9.* (custom) Unaffected: 4.10.95 , ≤ * (custom) cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-05T18:49:26.232581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T18:49:44.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.345",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.448",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.66",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.367",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.230",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.169",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.81",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.45",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.28",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.414",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.394",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.29",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Micro Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.0.0.145",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.147",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.141",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.375",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.419",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.248",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.248",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.124",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.31",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.365",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.224",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt",
"product": "org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "0.14.13.8",
"status": "affected",
"version": "0.14.13",
"versionType": "custom"
},
{
"lessThan": "0.14.16.1",
"status": "affected",
"version": "0.14.16",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core",
"product": "org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.2.14.7",
"status": "affected",
"version": "2.2.14",
"versionType": "custom"
},
{
"lessThan": "2.2.17.2",
"status": "affected",
"version": "2.2.17",
"versionType": "custom"
},
{
"lessThan": "2.3.1.3",
"status": "affected",
"version": "2.3.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "2.3.19",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.library",
"product": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.library",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.7.30.47",
"status": "affected",
"version": "4.7.30",
"versionType": "custom"
},
{
"lessThan": "4.7.61.62",
"status": "affected",
"version": "4.7.61",
"versionType": "custom"
},
{
"lessThan": "4.7.99.304",
"status": "affected",
"version": "4.7.99",
"versionType": "custom"
},
{
"lessThan": "4.7.131.22",
"status": "affected",
"version": "4.7.131",
"versionType": "custom"
},
{
"lessThan": "4.7.175.30",
"status": "affected",
"version": "4.7.175",
"versionType": "custom"
},
{
"lessThan": "4.7.188.12",
"status": "affected",
"version": "4.7.188",
"versionType": "custom"
},
{
"lessThan": "4.7.204.13",
"status": "affected",
"version": "4.7.204",
"versionType": "custom"
},
{
"lessThan": "4.7.221.7",
"status": "affected",
"version": "4.7.221",
"versionType": "custom"
},
{
"lessThan": "4.7.245.7",
"status": "affected",
"version": "4.7.245",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.7.262",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.deployment:org.wso2.carbon.module.mgt",
"product": "org.wso2.carbon.deployment:org.wso2.carbon.module.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.9.15.2",
"status": "affected",
"version": "4.9.15",
"versionType": "custom"
},
{
"lessThan": "4.10.1.1",
"status": "affected",
"version": "4.10.1",
"versionType": "custom"
},
{
"lessThan": "4.10.9.2",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.11.1.3",
"status": "affected",
"version": "4.11.1",
"versionType": "custom"
},
{
"lessThan": "4.11.3.3",
"status": "affected",
"version": "4.11.3",
"versionType": "custom"
},
{
"lessThan": "4.11.7.5",
"status": "affected",
"version": "4.11.7",
"versionType": "custom"
},
{
"lessThan": "4.11.14.2",
"status": "affected",
"version": "4.11.14",
"versionType": "custom"
},
{
"lessThan": "4.11.17.3",
"status": "affected",
"version": "4.11.17",
"versionType": "custom"
},
{
"lessThan": "4.11.18.1",
"status": "affected",
"version": "4.11.18",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.11.24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt",
"product": "org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.10.1.1",
"status": "affected",
"version": "4.10.1",
"versionType": "custom"
},
{
"lessThan": "4.10.9.2",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.11.1.3",
"status": "affected",
"version": "4.11.1",
"versionType": "custom"
},
{
"lessThan": "4.11.3.3",
"status": "affected",
"version": "4.11.3",
"versionType": "custom"
},
{
"lessThan": "4.11.7.5",
"status": "affected",
"version": "4.11.7",
"versionType": "custom"
},
{
"lessThan": "4.11.14.2",
"status": "affected",
"version": "4.11.14",
"versionType": "custom"
},
{
"lessThan": "4.11.17.3",
"status": "affected",
"version": "4.11.17",
"versionType": "custom"
},
{
"lessThan": "4.11.18.1",
"status": "affected",
"version": "4.11.18",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.11.24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.apache.ws.commons.axiom.wso2:axiom",
"product": "org.apache.ws.commons.axiom.wso2:axiom",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.2.11.wso2v17_5",
"status": "affected",
"version": "1.2.11",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.2.11-wso2v21",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.base",
"product": "org.wso2.carbon:org.wso2.carbon.base",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.3.46",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.2005",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.153",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.668",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.37",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.15",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.72",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.40",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.103",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.26",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.11",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.9.28.12",
"status": "affected",
"version": "4.9.28",
"versionType": "custom"
},
{
"lessThan": "4.10.9.71",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.10.42.14",
"status": "affected",
"version": "4.10.42",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.30",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.95",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.utils",
"product": "org.wso2.carbon:org.wso2.carbon.utils",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.3.46",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.2005",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.153",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.668",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.37",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.15",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.72",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.40",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.103",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.26",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.11",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.9.28.12",
"status": "affected",
"version": "4.9.28",
"versionType": "custom"
},
{
"lessThan": "4.10.9.71",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.10.42.14",
"status": "affected",
"version": "4.10.42",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.30",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.95",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.345",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.448",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.66",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.367",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.230",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.169",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.81",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.45",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.28",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.414",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.394",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.29",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.27",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.27",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.145",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.147",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.141",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.375",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.419",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.248",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.248",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.124",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0.31",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.365",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.224",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.13.8",
"versionStartIncluding": "0.14.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.16.1",
"versionStartIncluding": "0.14.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.14.7",
"versionStartIncluding": "2.2.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.17.2",
"versionStartIncluding": "2.2.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.1.3",
"versionStartIncluding": "2.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "2.3.19",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.30.47",
"versionStartIncluding": "4.7.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.61.62",
"versionStartIncluding": "4.7.61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.99.304",
"versionStartIncluding": "4.7.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.131.22",
"versionStartIncluding": "4.7.131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.175.30",
"versionStartIncluding": "4.7.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.188.12",
"versionStartIncluding": "4.7.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.204.13",
"versionStartIncluding": "4.7.204",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.221.7",
"versionStartIncluding": "4.7.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.245.7",
"versionStartIncluding": "4.7.245",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.7.262",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.15.2",
"versionStartIncluding": "4.9.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.1.1",
"versionStartIncluding": "4.10.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.2",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.1.3",
"versionStartIncluding": "4.11.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.3.3",
"versionStartIncluding": "4.11.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.7.5",
"versionStartIncluding": "4.11.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.14.2",
"versionStartIncluding": "4.11.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.17.3",
"versionStartIncluding": "4.11.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.18.1",
"versionStartIncluding": "4.11.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.11.24",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.1.1",
"versionStartIncluding": "4.10.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.2",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.1.3",
"versionStartIncluding": "4.11.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.3.3",
"versionStartIncluding": "4.11.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.7.5",
"versionStartIncluding": "4.11.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.14.2",
"versionStartIncluding": "4.11.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.17.3",
"versionStartIncluding": "4.11.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.18.1",
"versionStartIncluding": "4.11.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.11.24",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.apache.ws.commons.axiom.wso2_axiom:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.11.wso2v17_5",
"versionStartIncluding": "1.2.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.apache.ws.commons.axiom.wso2_axiom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "1.2.11-wso2v21",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.46",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.2005",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.153",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.2.668",
"versionStartIncluding": "4.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.37",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.15",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.72",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.40",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.103",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.26",
"versionStartIncluding": "4.9.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.27.11",
"versionStartIncluding": "4.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.28.12",
"versionStartIncluding": "4.9.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.71",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.42.14",
"versionStartIncluding": "4.10.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.9.*",
"versionStartIncluding": "4.9.30",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.10.95",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.46",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.2005",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.153",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.2.668",
"versionStartIncluding": "4.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.37",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.15",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.72",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.40",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.103",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.26",
"versionStartIncluding": "4.9.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.27.11",
"versionStartIncluding": "4.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.28.12",
"versionStartIncluding": "4.9.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.71",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.42.14",
"versionStartIncluding": "4.10.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.9.*",
"versionStartIncluding": "4.9.30",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.10.95",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "crnkovi\u0107"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.\u003cbr\u003e\u003cbr\u003eSuccessful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.\u003cbr\u003e"
}
],
"value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.\n\nSuccessful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T18:03:49.831Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4603",
"discovery": "EXTERNAL"
},
"title": "Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-10907",
"datePublished": "2025-11-05T18:03:49.831Z",
"dateReserved": "2025-09-24T09:25:09.461Z",
"dateUpdated": "2025-11-05T18:49:44.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-10907",
"date": "2026-09-20",
"epss": "0.00556",
"percentile": "0.45176"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.345",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.448",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.66",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.367",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.230",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.169",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.81",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.45",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.28",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.414",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.394",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.29",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Micro Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.0.0.145",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.147",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.141",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.375",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.419",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.248",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.248",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.124",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.31",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.365",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.224",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt",
"product": "org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "0.14.13.8",
"status": "affected",
"version": "0.14.13",
"versionType": "custom"
},
{
"lessThan": "0.14.16.1",
"status": "affected",
"version": "0.14.16",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core",
"product": "org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.2.14.7",
"status": "affected",
"version": "2.2.14",
"versionType": "custom"
},
{
"lessThan": "2.2.17.2",
"status": "affected",
"version": "2.2.17",
"versionType": "custom"
},
{
"lessThan": "2.3.1.3",
"status": "affected",
"version": "2.3.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "2.3.19",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.library",
"product": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.library",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.7.30.47",
"status": "affected",
"version": "4.7.30",
"versionType": "custom"
},
{
"lessThan": "4.7.61.62",
"status": "affected",
"version": "4.7.61",
"versionType": "custom"
},
{
"lessThan": "4.7.99.304",
"status": "affected",
"version": "4.7.99",
"versionType": "custom"
},
{
"lessThan": "4.7.131.22",
"status": "affected",
"version": "4.7.131",
"versionType": "custom"
},
{
"lessThan": "4.7.175.30",
"status": "affected",
"version": "4.7.175",
"versionType": "custom"
},
{
"lessThan": "4.7.188.12",
"status": "affected",
"version": "4.7.188",
"versionType": "custom"
},
{
"lessThan": "4.7.204.13",
"status": "affected",
"version": "4.7.204",
"versionType": "custom"
},
{
"lessThan": "4.7.221.7",
"status": "affected",
"version": "4.7.221",
"versionType": "custom"
},
{
"lessThan": "4.7.245.7",
"status": "affected",
"version": "4.7.245",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.7.262",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.deployment:org.wso2.carbon.module.mgt",
"product": "org.wso2.carbon.deployment:org.wso2.carbon.module.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.9.15.2",
"status": "affected",
"version": "4.9.15",
"versionType": "custom"
},
{
"lessThan": "4.10.1.1",
"status": "affected",
"version": "4.10.1",
"versionType": "custom"
},
{
"lessThan": "4.10.9.2",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.11.1.3",
"status": "affected",
"version": "4.11.1",
"versionType": "custom"
},
{
"lessThan": "4.11.3.3",
"status": "affected",
"version": "4.11.3",
"versionType": "custom"
},
{
"lessThan": "4.11.7.5",
"status": "affected",
"version": "4.11.7",
"versionType": "custom"
},
{
"lessThan": "4.11.14.2",
"status": "affected",
"version": "4.11.14",
"versionType": "custom"
},
{
"lessThan": "4.11.17.3",
"status": "affected",
"version": "4.11.17",
"versionType": "custom"
},
{
"lessThan": "4.11.18.1",
"status": "affected",
"version": "4.11.18",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.11.24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt",
"product": "org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.10.1.1",
"status": "affected",
"version": "4.10.1",
"versionType": "custom"
},
{
"lessThan": "4.10.9.2",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.11.1.3",
"status": "affected",
"version": "4.11.1",
"versionType": "custom"
},
{
"lessThan": "4.11.3.3",
"status": "affected",
"version": "4.11.3",
"versionType": "custom"
},
{
"lessThan": "4.11.7.5",
"status": "affected",
"version": "4.11.7",
"versionType": "custom"
},
{
"lessThan": "4.11.14.2",
"status": "affected",
"version": "4.11.14",
"versionType": "custom"
},
{
"lessThan": "4.11.17.3",
"status": "affected",
"version": "4.11.17",
"versionType": "custom"
},
{
"lessThan": "4.11.18.1",
"status": "affected",
"version": "4.11.18",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.11.24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.apache.ws.commons.axiom.wso2:axiom",
"product": "org.apache.ws.commons.axiom.wso2:axiom",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.2.11.wso2v17_5",
"status": "affected",
"version": "1.2.11",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.2.11-wso2v21",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.base",
"product": "org.wso2.carbon:org.wso2.carbon.base",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.3.46",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.2005",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.153",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.668",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.37",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.15",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.72",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.40",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.103",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.26",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.11",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.9.28.12",
"status": "affected",
"version": "4.9.28",
"versionType": "custom"
},
{
"lessThan": "4.10.9.71",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.10.42.14",
"status": "affected",
"version": "4.10.42",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.30",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.95",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.utils",
"product": "org.wso2.carbon:org.wso2.carbon.utils",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.3.46",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.2005",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.153",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.668",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.37",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.15",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.72",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.40",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.103",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.26",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.11",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.9.28.12",
"status": "affected",
"version": "4.9.28",
"versionType": "custom"
},
{
"lessThan": "4.10.9.71",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.10.42.14",
"status": "affected",
"version": "4.10.42",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.30",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.95",
"versionType": "custom"
}
]
}
],
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
"matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
"matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "EA76533A-5BED-4BDC-B348-EB3D3FDFB110",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "C1EFBD0F-9664-4EF3-9908-C72B1318F68F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "A5358E6E-8C01-408D-8692-B1A326DC630F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C7413107-D7B2-49AE-AC46-52E7BFCD6ED8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "61636553-C25E-44DF-93D7-EB3E1056D1DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.\n\nSuccessful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services."
}
],
"id": "CVE-2025-10907",
"lastModified": "2026-06-17T08:29:14.897",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 6.0,
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-10907",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-05T18:49:26.232581Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-11-05T18:15:33.347",
"references": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"tags": [
"Vendor Advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/"
}
],
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-11-07T13:46:06+00:00",
"cve": "CVE-2025-10907",
"id": "CVE-2025-10907",
"initial_release_date": "2025-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-10907.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-10907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-05T18:49:26.232581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T18:49:29.894Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.1.0.345",
"status": "affected",
"version": "3.1.0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.448",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.66",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.0.0.367",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.230",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.169",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.81",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.45",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.28",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking IAM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.414",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Open Banking AM",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2.0.0.394",
"status": "affected",
"version": "2.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.29",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.27",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Micro Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.0.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.0.0.145",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.147",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.141",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.375",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
},
{
"lessThan": "5.11.0.419",
"status": "affected",
"version": "5.11.0",
"versionType": "custom"
},
{
"lessThan": "6.0.0.248",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.0.248",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThan": "7.0.0.124",
"status": "affected",
"version": "7.0.0",
"versionType": "custom"
},
{
"lessThan": "7.1.0.31",
"status": "affected",
"version": "7.1.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Identity Server as Key Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.10.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "5.10.0.365",
"status": "affected",
"version": "5.10.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Enterprise Integrator",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.6.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "6.6.0.224",
"status": "affected",
"version": "6.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt",
"product": "org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "0.14.13.8",
"status": "affected",
"version": "0.14.13",
"versionType": "custom"
},
{
"lessThan": "0.14.16.1",
"status": "affected",
"version": "0.14.16",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core",
"product": "org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core",
"vendor": "WSO2",
"versions": [
{
"lessThan": "2.2.14.7",
"status": "affected",
"version": "2.2.14",
"versionType": "custom"
},
{
"lessThan": "2.2.17.2",
"status": "affected",
"version": "2.2.17",
"versionType": "custom"
},
{
"lessThan": "2.3.1.3",
"status": "affected",
"version": "2.3.1",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "2.3.19",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.library",
"product": "org.wso2.carbon.mediation:org.wso2.carbon.mediation.library",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.7.30.47",
"status": "affected",
"version": "4.7.30",
"versionType": "custom"
},
{
"lessThan": "4.7.61.62",
"status": "affected",
"version": "4.7.61",
"versionType": "custom"
},
{
"lessThan": "4.7.99.304",
"status": "affected",
"version": "4.7.99",
"versionType": "custom"
},
{
"lessThan": "4.7.131.22",
"status": "affected",
"version": "4.7.131",
"versionType": "custom"
},
{
"lessThan": "4.7.175.30",
"status": "affected",
"version": "4.7.175",
"versionType": "custom"
},
{
"lessThan": "4.7.188.12",
"status": "affected",
"version": "4.7.188",
"versionType": "custom"
},
{
"lessThan": "4.7.204.13",
"status": "affected",
"version": "4.7.204",
"versionType": "custom"
},
{
"lessThan": "4.7.221.7",
"status": "affected",
"version": "4.7.221",
"versionType": "custom"
},
{
"lessThan": "4.7.245.7",
"status": "affected",
"version": "4.7.245",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.7.262",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.deployment:org.wso2.carbon.module.mgt",
"product": "org.wso2.carbon.deployment:org.wso2.carbon.module.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.9.15.2",
"status": "affected",
"version": "4.9.15",
"versionType": "custom"
},
{
"lessThan": "4.10.1.1",
"status": "affected",
"version": "4.10.1",
"versionType": "custom"
},
{
"lessThan": "4.10.9.2",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.11.1.3",
"status": "affected",
"version": "4.11.1",
"versionType": "custom"
},
{
"lessThan": "4.11.3.3",
"status": "affected",
"version": "4.11.3",
"versionType": "custom"
},
{
"lessThan": "4.11.7.5",
"status": "affected",
"version": "4.11.7",
"versionType": "custom"
},
{
"lessThan": "4.11.14.2",
"status": "affected",
"version": "4.11.14",
"versionType": "custom"
},
{
"lessThan": "4.11.17.3",
"status": "affected",
"version": "4.11.17",
"versionType": "custom"
},
{
"lessThan": "4.11.18.1",
"status": "affected",
"version": "4.11.18",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.11.24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt",
"product": "org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.10.1.1",
"status": "affected",
"version": "4.10.1",
"versionType": "custom"
},
{
"lessThan": "4.10.9.2",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.11.1.3",
"status": "affected",
"version": "4.11.1",
"versionType": "custom"
},
{
"lessThan": "4.11.3.3",
"status": "affected",
"version": "4.11.3",
"versionType": "custom"
},
{
"lessThan": "4.11.7.5",
"status": "affected",
"version": "4.11.7",
"versionType": "custom"
},
{
"lessThan": "4.11.14.2",
"status": "affected",
"version": "4.11.14",
"versionType": "custom"
},
{
"lessThan": "4.11.17.3",
"status": "affected",
"version": "4.11.17",
"versionType": "custom"
},
{
"lessThan": "4.11.18.1",
"status": "affected",
"version": "4.11.18",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.11.24",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.apache.ws.commons.axiom.wso2:axiom",
"product": "org.apache.ws.commons.axiom.wso2:axiom",
"vendor": "WSO2",
"versions": [
{
"lessThan": "1.2.11.wso2v17_5",
"status": "affected",
"version": "1.2.11",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "1.2.11-wso2v21",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.base",
"product": "org.wso2.carbon:org.wso2.carbon.base",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.3.46",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.2005",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.153",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.668",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.37",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.15",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.72",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.40",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.103",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.26",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.11",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.9.28.12",
"status": "affected",
"version": "4.9.28",
"versionType": "custom"
},
{
"lessThan": "4.10.9.71",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.10.42.14",
"status": "affected",
"version": "4.10.42",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.30",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.95",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.utils",
"product": "org.wso2.carbon:org.wso2.carbon.utils",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.3.46",
"status": "affected",
"version": "4.5.3",
"versionType": "custom"
},
{
"lessThan": "4.6.0.2005",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
},
{
"lessThan": "4.6.1.153",
"status": "affected",
"version": "4.6.1",
"versionType": "custom"
},
{
"lessThan": "4.6.2.668",
"status": "affected",
"version": "4.6.2",
"versionType": "custom"
},
{
"lessThan": "4.6.3.37",
"status": "affected",
"version": "4.6.3",
"versionType": "custom"
},
{
"lessThan": "4.6.4.15",
"status": "affected",
"version": "4.6.4",
"versionType": "custom"
},
{
"lessThan": "4.7.1.72",
"status": "affected",
"version": "4.7.1",
"versionType": "custom"
},
{
"lessThan": "4.8.1.40",
"status": "affected",
"version": "4.8.1",
"versionType": "custom"
},
{
"lessThan": "4.9.0.103",
"status": "affected",
"version": "4.9.0",
"versionType": "custom"
},
{
"lessThan": "4.9.26.26",
"status": "affected",
"version": "4.9.26",
"versionType": "custom"
},
{
"lessThan": "4.9.27.11",
"status": "affected",
"version": "4.9.27",
"versionType": "custom"
},
{
"lessThan": "4.9.28.12",
"status": "affected",
"version": "4.9.28",
"versionType": "custom"
},
{
"lessThan": "4.10.9.71",
"status": "affected",
"version": "4.10.9",
"versionType": "custom"
},
{
"lessThan": "4.10.42.14",
"status": "affected",
"version": "4.10.42",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.30",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "4.10.95",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.1.0.345",
"versionStartIncluding": "3.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.448",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.66",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.367",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.230",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.169",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.81",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.45",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.28",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.414",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.0.394",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.29",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.27",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.27",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.0.145",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.147",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.141",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.375",
"versionStartIncluding": "5.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0.419",
"versionStartIncluding": "5.11.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.0.248",
"versionStartIncluding": "6.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.0.248",
"versionStartIncluding": "6.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.0.124",
"versionStartIncluding": "7.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.0.31",
"versionStartIncluding": "7.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.0.365",
"versionStartIncluding": "5.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.0.224",
"versionStartIncluding": "6.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.13.8",
"versionStartIncluding": "0.14.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "0.14.16.1",
"versionStartIncluding": "0.14.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.14.7",
"versionStartIncluding": "2.2.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.2.17.2",
"versionStartIncluding": "2.2.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.3.1.3",
"versionStartIncluding": "2.3.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "2.3.19",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.30.47",
"versionStartIncluding": "4.7.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.61.62",
"versionStartIncluding": "4.7.61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.99.304",
"versionStartIncluding": "4.7.99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.131.22",
"versionStartIncluding": "4.7.131",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.175.30",
"versionStartIncluding": "4.7.175",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.188.12",
"versionStartIncluding": "4.7.188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.204.13",
"versionStartIncluding": "4.7.204",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.221.7",
"versionStartIncluding": "4.7.221",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.245.7",
"versionStartIncluding": "4.7.245",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.7.262",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.15.2",
"versionStartIncluding": "4.9.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.1.1",
"versionStartIncluding": "4.10.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.2",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.1.3",
"versionStartIncluding": "4.11.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.3.3",
"versionStartIncluding": "4.11.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.7.5",
"versionStartIncluding": "4.11.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.14.2",
"versionStartIncluding": "4.11.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.17.3",
"versionStartIncluding": "4.11.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.18.1",
"versionStartIncluding": "4.11.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.11.24",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.1.1",
"versionStartIncluding": "4.10.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.2",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.1.3",
"versionStartIncluding": "4.11.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.3.3",
"versionStartIncluding": "4.11.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.7.5",
"versionStartIncluding": "4.11.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.14.2",
"versionStartIncluding": "4.11.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.17.3",
"versionStartIncluding": "4.11.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.11.18.1",
"versionStartIncluding": "4.11.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.11.24",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.apache.ws.commons.axiom.wso2_axiom:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.2.11.wso2v17_5",
"versionStartIncluding": "1.2.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.apache.ws.commons.axiom.wso2_axiom:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "1.2.11-wso2v21",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.46",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.2005",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.153",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.2.668",
"versionStartIncluding": "4.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.37",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.15",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.72",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.40",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.103",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.26",
"versionStartIncluding": "4.9.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.27.11",
"versionStartIncluding": "4.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.28.12",
"versionStartIncluding": "4.9.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.71",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.42.14",
"versionStartIncluding": "4.10.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.9.*",
"versionStartIncluding": "4.9.30",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.10.95",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.3.46",
"versionStartIncluding": "4.5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.2005",
"versionStartIncluding": "4.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.1.153",
"versionStartIncluding": "4.6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.2.668",
"versionStartIncluding": "4.6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.3.37",
"versionStartIncluding": "4.6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.4.15",
"versionStartIncluding": "4.6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.7.1.72",
"versionStartIncluding": "4.7.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.8.1.40",
"versionStartIncluding": "4.8.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.0.103",
"versionStartIncluding": "4.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.26.26",
"versionStartIncluding": "4.9.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.27.11",
"versionStartIncluding": "4.9.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.28.12",
"versionStartIncluding": "4.9.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.9.71",
"versionStartIncluding": "4.10.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.10.42.14",
"versionStartIncluding": "4.10.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.9.*",
"versionStartIncluding": "4.9.30",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "4.10.95",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "crnkovi\u0107"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.\u003cbr\u003e\u003cbr\u003eSuccessful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.\u003cbr\u003e"
}
],
"value": "An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.\n\nSuccessful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T18:03:49.831Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4603",
"discovery": "EXTERNAL"
},
"title": "Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-10907",
"datePublished": "2025-11-05T18:03:49.831Z",
"dateReserved": "2025-09-24T09:25:09.461Z",
"dateUpdated": "2025-11-05T18:49:44.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…