Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2025-9804

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a4b78a4e034b12862778514f982dfc11656db522140644f78c014803ac455241
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 21 assertions

{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.139","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.140","status":"affected","version":"1.5.0","versionType":"custom"},{"lessThan":"2.0.0.389","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/4

{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","vendor":"WSO2","versions":[{"lessThan":"5.2.0.4","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.2.2.21","status":"affected","version":"5.2.2","versionType":"custom"},{"lessThan":"5.7.5.18","status":"affected","version":"5.7.5","versionType":"custom"},{"lessThan":"5.11.148.19","status":"affected","version":"5.11.148","versionType":"custom"},{"lessThan":"5.11.25…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/18

{"defaultStatus":"unaffected","product":"WSO2 Data Analytics Server","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.20","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.33","status":"affected","version":"3.2.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/10

{"defaultStatus":"unaffected","product":"WSO2 Enterprise Service Bus Analytics","vendor":"WSO2","versions":[{"lessThan":"5.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.0.0.13","status":"affected","version":"5.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/9

{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.409","status":"affected","version":"2.0.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/3

{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.34","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.36","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.0.34","status":"affected","version":"5.4.0","versionType":"custom"},{"lessThan":"5.4.1.38","status":"affected","version":"5.4.1","versionType":"custom"},{"lessThan":"5.5.0.52","status":"affected","version":"5.5.0","versionType":"custom"},{"lessT…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/12

{"defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","vendor":"WSO2","versions":[{"lessThan":"6.7.206.567","status":"affected","version":"6.7.206","versionType":"custom"},{"lessThan":"6.7.210.63","status":"affected","version":"6.7.210","versionType":"custom"},{"lessThan":"9.0.174.522","status":"affected","version":"9.0.174","versionType":"custom"},{"lessThan":"9.20.74.379","status":"affected","version":"9.20.74","versionType":"custom"},{"lessThan":"9.28.116.360","status":"a…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/16

{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.3.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.3.0.41","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.53","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.75","status":"affected","version":"5.6.0","versionType":"custom"},{"lessThan":"5.7.0.125","status":"affected","version":"5.7.0","versionType":"custom"},{"lessThan":"5.9.0.176","status":"affected","version":"5.9.0","versionType":…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/14

{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.24","status":"affected","version":"4.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/13

{"defaultStatus":"unaffected","product":"WSO2 Open Banking KM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.133","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.123","status":"affected","version":"1.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/2

{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.base","product":"org.wso2.carbon:org.wso2.carbon.base","vendor":"WSO2","versions":[{"lessThan":"4.4.7.6","status":"affected","version":"4.4.7","versionType":"custom"},{"lessThan":"4.4.9.11","status":"affected","version":"4.4.9","versionType":"custom"},{"lessThan":"4.4.11.9","status":"affected","version":"4.4.11","versionType":"custom"},{"lessThan":"4.4.26.12","status":"affected","version":"4.4.26","versionType":"custom"},{"lessThan":"4.4.35.44","status":"affected","version":"4.4.35","versionType":"custom"},{"lessThan":"4…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/17

{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","vendor":"WSO2","versions":[{"lessThan":"5.1.1.1","status":"affected","version":"5.1.1","versionType":"custom"},{"lessThan":"5.1.2.1","status":"affected","version":"5.1.2","versionType":"custom"},{"lessThan":"5.1.5.1","status":"affected","version":"5.1.5","versionType":"custom"},{"lessThan":"5.3.3.1","status":"affected","version":"5.3.3","versionType":"custom"},{"lessThan":"5.4.0.4","status":"aff…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/20

{"defaultStatus":"unknown","packageName":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","vendor":"WSO2","versions":[{"lessThan":"2.0.10.1","status":"affected","version":"2.0.10","versionType":"custom"},{"lessThan":"2.0.15.1","status":"affected","version":"2.0.15","versionType":"custom"},{"lessThan":"2.0.21.1","status":"affected","version":"2.0.21","versionType":"custom"},{"les…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/15

{"defaultStatus":"unaffected","product":"API Manager Analytics","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.14","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.1.0.19","status":"affected","version":"2.1.0","versionType":"custom"},{"lessThan":"2.2.0.30","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.39","status":"affected","version":"2.5.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/7

{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.server.admin","product":"org.wso2.carbon:org.wso2.carbon.server.admin","vendor":"WSO2","versions":[{"lessThan":"4.4.7.6","status":"affected","version":"4.4.7","versionType":"custom"},{"lessThan":"4.4.9.11","status":"affected","version":"4.4.9","versionType":"custom"},{"lessThan":"4.4.11.9","status":"affected","version":"4.4.11","versionType":"custom"},{"lessThan":"4.4.26.12","status":"affected","version":"4.4.26","versionType":"custom"},{"lessThan":"4.4.32.16","status":"affected","version":"4.4.32","versionType":"custom"…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/19

{"defaultStatus":"unaffected","product":"WSO2 Identity Server Analytics","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.19","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.17","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.31","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.38","status":"affected","version":"5.6.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/6

{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.2.0.62","status":"affected","version":"6.2.0","versionType":"custom"},{"lessThan":"6.3.0.70","status":"affected","version":"6.3.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/8

{"defaultStatus":"unaffected","product":"WSO2 Enterprise Mobility Manager","vendor":"WSO2","versions":[{"lessThan":"2.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.2.0.28","status":"affected","version":"2.2.0","versionType":"custom"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/11

{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.31","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.1.0.40","status":"affected","version":"2.1.0","versionType":"custom"},{"lessThan":"2.2.0.59","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.85","status":"affected","version":"2.5.0","versionType":"custom"},{"lessThan":"2.6.0.146","status":"affected","version":"2.6.0","versionType":"custom"},{"lessThan…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/5
cvss · 2 assertions

{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/metrics/0/cvssV3_1

{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/metrics/1/cvssV3_1

Affected products and versions

21 source assertions
{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.139","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.140","status":"affected","version":"1.5.0","versionType":"custom"},{"lessThan":"2.0.0.389","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/4
{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","product":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt","vendor":"WSO2","versions":[{"lessThan":"5.2.0.4","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.2.2.21","status":"affected","version":"5.2.2","versionType":"custom"},{"lessThan":"5.7.5.18","status":"affected","version":"5.7.5","versionType":"custom"},{"lessThan":"5.11.148.19","status":"affected","version":"5.11.148","versionType":"custom"},{"lessThan":"5.11.25…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/18
{"defaultStatus":"unaffected","product":"WSO2 Data Analytics Server","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.20","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.33","status":"affected","version":"3.2.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/10
{"defaultStatus":"unaffected","product":"WSO2 Enterprise Service Bus Analytics","vendor":"WSO2","versions":[{"lessThan":"5.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.0.0.13","status":"affected","version":"5.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/9
{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.409","status":"affected","version":"2.0.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/3
{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.34","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.36","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.4.0.34","status":"affected","version":"5.4.0","versionType":"custom"},{"lessThan":"5.4.1.38","status":"affected","version":"5.4.1","versionType":"custom"},{"lessThan":"5.5.0.52","status":"affected","version":"5.5.0","versionType":"custom"},{"lessT…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/12
{"defaultStatus":"unknown","packageName":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","product":"org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util","vendor":"WSO2","versions":[{"lessThan":"6.7.206.567","status":"affected","version":"6.7.206","versionType":"custom"},{"lessThan":"6.7.210.63","status":"affected","version":"6.7.210","versionType":"custom"},{"lessThan":"9.0.174.522","status":"affected","version":"9.0.174","versionType":"custom"},{"lessThan":"9.20.74.379","status":"affected","version":"9.20.74","versionType":"custom"},{"lessThan":"9.28.116.360","status":"a…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/16
{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.3.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.3.0.41","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.53","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.75","status":"affected","version":"5.6.0","versionType":"custom"},{"lessThan":"5.7.0.125","status":"affected","version":"5.7.0","versionType":"custom"},{"lessThan":"5.9.0.176","status":"affected","version":"5.9.0","versionType":…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0.22","status":"affected","version":"4.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/14
{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.24","status":"affected","version":"4.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/13
{"defaultStatus":"unaffected","product":"WSO2 Open Banking KM","vendor":"WSO2","versions":[{"lessThan":"1.4.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.4.0.133","status":"affected","version":"1.4.0","versionType":"custom"},{"lessThan":"1.5.0.123","status":"affected","version":"1.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/2
{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.base","product":"org.wso2.carbon:org.wso2.carbon.base","vendor":"WSO2","versions":[{"lessThan":"4.4.7.6","status":"affected","version":"4.4.7","versionType":"custom"},{"lessThan":"4.4.9.11","status":"affected","version":"4.4.9","versionType":"custom"},{"lessThan":"4.4.11.9","status":"affected","version":"4.4.11","versionType":"custom"},{"lessThan":"4.4.26.12","status":"affected","version":"4.4.26","versionType":"custom"},{"lessThan":"4.4.35.44","status":"affected","version":"4.4.35","versionType":"custom"},{"lessThan":"4…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/17
{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","product":"org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow","vendor":"WSO2","versions":[{"lessThan":"5.1.1.1","status":"affected","version":"5.1.1","versionType":"custom"},{"lessThan":"5.1.2.1","status":"affected","version":"5.1.2","versionType":"custom"},{"lessThan":"5.1.5.1","status":"affected","version":"5.1.5","versionType":"custom"},{"lessThan":"5.3.3.1","status":"affected","version":"5.3.3","versionType":"custom"},{"lessThan":"5.4.0.4","status":"aff…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/20
{"defaultStatus":"unknown","packageName":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","product":"org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector","vendor":"WSO2","versions":[{"lessThan":"2.0.10.1","status":"affected","version":"2.0.10","versionType":"custom"},{"lessThan":"2.0.15.1","status":"affected","version":"2.0.15","versionType":"custom"},{"lessThan":"2.0.21.1","status":"affected","version":"2.0.21","versionType":"custom"},{"les…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/15
{"defaultStatus":"unaffected","product":"API Manager Analytics","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.14","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.1.0.19","status":"affected","version":"2.1.0","versionType":"custom"},{"lessThan":"2.2.0.30","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.39","status":"affected","version":"2.5.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/7
{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.server.admin","product":"org.wso2.carbon:org.wso2.carbon.server.admin","vendor":"WSO2","versions":[{"lessThan":"4.4.7.6","status":"affected","version":"4.4.7","versionType":"custom"},{"lessThan":"4.4.9.11","status":"affected","version":"4.4.9","versionType":"custom"},{"lessThan":"4.4.11.9","status":"affected","version":"4.4.11","versionType":"custom"},{"lessThan":"4.4.26.12","status":"affected","version":"4.4.26","versionType":"custom"},{"lessThan":"4.4.32.16","status":"affected","version":"4.4.32","versionType":"custom"…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/19
{"defaultStatus":"unaffected","product":"WSO2 Identity Server Analytics","vendor":"WSO2","versions":[{"lessThan":"5.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.2.0.19","status":"affected","version":"5.2.0","versionType":"custom"},{"lessThan":"5.3.0.17","status":"affected","version":"5.3.0","versionType":"custom"},{"lessThan":"5.5.0.31","status":"affected","version":"5.5.0","versionType":"custom"},{"lessThan":"5.6.0.38","status":"affected","version":"5.6.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/6
{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.2.0.62","status":"affected","version":"6.2.0","versionType":"custom"},{"lessThan":"6.3.0.70","status":"affected","version":"6.3.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/8
{"defaultStatus":"unaffected","product":"WSO2 Enterprise Mobility Manager","vendor":"WSO2","versions":[{"lessThan":"2.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.2.0.28","status":"affected","version":"2.2.0","versionType":"custom"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/11
{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.31","status":"affected","version":"2.0.0","versionType":"custom"},{"lessThan":"2.1.0.40","status":"affected","version":"2.1.0","versionType":"custom"},{"lessThan":"2.2.0.59","status":"affected","version":"2.2.0","versionType":"custom"},{"lessThan":"2.5.0.85","status":"affected","version":"2.5.0","versionType":"custom"},{"lessThan":"2.6.0.146","status":"affected","version":"2.6.0","versionType":"custom"},{"lessThan…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/affected/5

Provider-owned CVSS observations

2 source assertions
{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/metrics/0/cvssV3_1
{"metric":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"LOW","baseScore":8.9,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/metrics/1/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/adp/0/problemTypes/0/descriptions/0

Source references

1 source assertion
{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7c5dc684d78a82d054ecade0a429481abe514604285b0ead19aa5566aec4ba7d · sha256:0c216a81d795e0d7… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer