1013 lines
50 KiB
JSON
1013 lines
50 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2025-9312",
|
||
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "WSO2",
|
||
"dateReserved": "2025-08-21T07:28:14.505Z",
|
||
"datePublished": "2025-11-18T12:05:22.207Z",
|
||
"dateUpdated": "2025-11-18T17:38:15.686Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 API Manager",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "2.2.0",
|
||
"status": "unknown",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "2.2.0.58",
|
||
"status": "affected",
|
||
"version": "2.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "2.5.0.84",
|
||
"status": "affected",
|
||
"version": "2.5.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "2.6.0.145",
|
||
"status": "affected",
|
||
"version": "2.6.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "3.0.0.175",
|
||
"status": "affected",
|
||
"version": "3.0.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "3.1.0.339",
|
||
"status": "affected",
|
||
"version": "3.1.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "3.2.0.439",
|
||
"status": "affected",
|
||
"version": "3.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "3.2.1.59",
|
||
"status": "affected",
|
||
"version": "3.2.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "4.0.0.359",
|
||
"status": "affected",
|
||
"version": "4.0.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "4.1.0.222",
|
||
"status": "affected",
|
||
"version": "4.1.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "4.2.0.161",
|
||
"status": "affected",
|
||
"version": "4.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "4.3.0.73",
|
||
"status": "affected",
|
||
"version": "4.3.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "4.4.0.37",
|
||
"status": "affected",
|
||
"version": "4.4.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "4.5.0.21",
|
||
"status": "affected",
|
||
"version": "4.5.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 API Control Plane",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "4.5.0.22",
|
||
"status": "affected",
|
||
"version": "4.5.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 Traffic Manager",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "4.5.0.20",
|
||
"status": "affected",
|
||
"version": "4.5.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 Universal Gateway",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "4.5.0.20",
|
||
"status": "affected",
|
||
"version": "4.5.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 Identity Server as Key Manager",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "5.3.0",
|
||
"status": "unknown",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.3.0.39",
|
||
"status": "affected",
|
||
"version": "5.3.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.5.0.52",
|
||
"status": "affected",
|
||
"version": "5.5.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.6.0.74",
|
||
"status": "affected",
|
||
"version": "5.6.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.7.0.124",
|
||
"status": "affected",
|
||
"version": "5.7.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.9.0.175",
|
||
"status": "affected",
|
||
"version": "5.9.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.10.0.358",
|
||
"status": "affected",
|
||
"version": "5.10.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 Identity Server",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "5.2.0",
|
||
"status": "unknown",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.2.0.33",
|
||
"status": "affected",
|
||
"version": "5.2.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.3.0.34",
|
||
"status": "affected",
|
||
"version": "5.3.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.4.0.33",
|
||
"status": "affected",
|
||
"version": "5.4.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.4.1.37",
|
||
"status": "affected",
|
||
"version": "5.4.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.5.0.51",
|
||
"status": "affected",
|
||
"version": "5.5.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.6.0.59",
|
||
"status": "affected",
|
||
"version": "5.6.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.7.0.125",
|
||
"status": "affected",
|
||
"version": "5.7.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.8.0.109",
|
||
"status": "affected",
|
||
"version": "5.8.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.9.0.168",
|
||
"status": "affected",
|
||
"version": "5.9.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.10.0.368",
|
||
"status": "affected",
|
||
"version": "5.10.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "5.11.0.411",
|
||
"status": "affected",
|
||
"version": "5.11.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "6.0.0.243",
|
||
"status": "affected",
|
||
"version": "6.0.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "6.1.0.241",
|
||
"status": "affected",
|
||
"version": "6.1.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "7.0.0.116",
|
||
"status": "affected",
|
||
"version": "7.0.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "7.1.0.23",
|
||
"status": "affected",
|
||
"version": "7.1.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 Open Banking KM",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.4.0",
|
||
"status": "unknown",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.4.0.132",
|
||
"status": "affected",
|
||
"version": "1.4.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.5.0.122",
|
||
"status": "affected",
|
||
"version": "1.5.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 Open Banking AM",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.4.0",
|
||
"status": "unknown",
|
||
"version": "0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.4.0.138",
|
||
"status": "affected",
|
||
"version": "1.4.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.5.0.139",
|
||
"status": "affected",
|
||
"version": "1.5.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "2.0.0.388",
|
||
"status": "affected",
|
||
"version": "2.0.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unaffected",
|
||
"product": "WSO2 Open Banking IAM",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "2.0.0.408",
|
||
"status": "affected",
|
||
"version": "2.0.0",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"defaultStatus": "unknown",
|
||
"packageName": "org.wso2.carbon.identity.auth.service",
|
||
"product": "org.wso2.carbon.identity.auth.service",
|
||
"vendor": "WSO2",
|
||
"versions": [
|
||
{
|
||
"lessThan": "1.1.1.2",
|
||
"status": "affected",
|
||
"version": "1.1.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.1.16.3",
|
||
"status": "affected",
|
||
"version": "1.1.16",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.1.18.4",
|
||
"status": "affected",
|
||
"version": "1.1.18",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.1.20.5",
|
||
"status": "affected",
|
||
"version": "1.1.20",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.1.26.7",
|
||
"status": "affected",
|
||
"version": "1.1.26",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.3.6.8",
|
||
"status": "affected",
|
||
"version": "1.3.6",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.4.0.18",
|
||
"status": "affected",
|
||
"version": "1.4.0",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.4.25.24",
|
||
"status": "affected",
|
||
"version": "1.4.25",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.4.52.4",
|
||
"status": "affected",
|
||
"version": "1.4.52",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.6.1.11",
|
||
"status": "affected",
|
||
"version": "1.6.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.7.1.4",
|
||
"status": "affected",
|
||
"version": "1.7.1",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.8.11.6",
|
||
"status": "affected",
|
||
"version": "1.8.11",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.8.41.2",
|
||
"status": "affected",
|
||
"version": "1.8.41",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.9.4.4",
|
||
"status": "affected",
|
||
"version": "1.9.4",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThan": "1.9.18.2",
|
||
"status": "affected",
|
||
"version": "1.9.18",
|
||
"versionType": "custom"
|
||
},
|
||
{
|
||
"lessThanOrEqual": "5.5.2.*",
|
||
"status": "unaffected",
|
||
"version": "5.5.2",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "2.2.0.58",
|
||
"versionStartIncluding": "2.2.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "2.5.0.84",
|
||
"versionStartIncluding": "2.5.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "2.6.0.145",
|
||
"versionStartIncluding": "2.6.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "3.0.0.175",
|
||
"versionStartIncluding": "3.0.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "3.1.0.339",
|
||
"versionStartIncluding": "3.1.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "3.2.0.439",
|
||
"versionStartIncluding": "3.2.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "3.2.1.59",
|
||
"versionStartIncluding": "3.2.1",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.0.0.359",
|
||
"versionStartIncluding": "4.0.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.1.0.222",
|
||
"versionStartIncluding": "4.1.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.2.0.161",
|
||
"versionStartIncluding": "4.2.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.3.0.73",
|
||
"versionStartIncluding": "4.3.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.4.0.37",
|
||
"versionStartIncluding": "4.4.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.5.0.21",
|
||
"versionStartIncluding": "4.5.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.5.0.22",
|
||
"versionStartIncluding": "4.5.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.5.0.20",
|
||
"versionStartIncluding": "4.5.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "4.5.0.20",
|
||
"versionStartIncluding": "4.5.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.3.0.39",
|
||
"versionStartIncluding": "5.3.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.5.0.52",
|
||
"versionStartIncluding": "5.5.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.6.0.74",
|
||
"versionStartIncluding": "5.6.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.7.0.124",
|
||
"versionStartIncluding": "5.7.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.9.0.175",
|
||
"versionStartIncluding": "5.9.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.10.0.358",
|
||
"versionStartIncluding": "5.10.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.2.0.33",
|
||
"versionStartIncluding": "5.2.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.3.0.34",
|
||
"versionStartIncluding": "5.3.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.4.0.33",
|
||
"versionStartIncluding": "5.4.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.4.1.37",
|
||
"versionStartIncluding": "5.4.1",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.5.0.51",
|
||
"versionStartIncluding": "5.5.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.6.0.59",
|
||
"versionStartIncluding": "5.6.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.7.0.125",
|
||
"versionStartIncluding": "5.7.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.8.0.109",
|
||
"versionStartIncluding": "5.8.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.9.0.168",
|
||
"versionStartIncluding": "5.9.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.10.0.368",
|
||
"versionStartIncluding": "5.10.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "5.11.0.411",
|
||
"versionStartIncluding": "5.11.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "6.0.0.243",
|
||
"versionStartIncluding": "6.0.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "6.1.0.241",
|
||
"versionStartIncluding": "6.1.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "7.0.0.116",
|
||
"versionStartIncluding": "7.0.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "7.1.0.23",
|
||
"versionStartIncluding": "7.1.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_km:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.4.0.132",
|
||
"versionStartIncluding": "1.4.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_km:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.5.0.122",
|
||
"versionStartIncluding": "1.5.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.4.0.138",
|
||
"versionStartIncluding": "1.4.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.5.0.139",
|
||
"versionStartIncluding": "1.5.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "2.0.0.388",
|
||
"versionStartIncluding": "2.0.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "2.0.0.408",
|
||
"versionStartIncluding": "2.0.0",
|
||
"vulnerable": true
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
},
|
||
{
|
||
"cpeMatch": [
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.1.1.2",
|
||
"versionStartIncluding": "1.1.1",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.1.16.3",
|
||
"versionStartIncluding": "1.1.16",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.1.18.4",
|
||
"versionStartIncluding": "1.1.18",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.1.20.5",
|
||
"versionStartIncluding": "1.1.20",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.1.26.7",
|
||
"versionStartIncluding": "1.1.26",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.3.6.8",
|
||
"versionStartIncluding": "1.3.6",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.4.0.18",
|
||
"versionStartIncluding": "1.4.0",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.4.25.24",
|
||
"versionStartIncluding": "1.4.25",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.4.52.4",
|
||
"versionStartIncluding": "1.4.52",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.6.1.11",
|
||
"versionStartIncluding": "1.6.1",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.7.1.4",
|
||
"versionStartIncluding": "1.7.1",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.8.11.6",
|
||
"versionStartIncluding": "1.8.11",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.8.41.2",
|
||
"versionStartIncluding": "1.8.41",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.9.4.4",
|
||
"versionStartIncluding": "1.9.4",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndExcluding": "1.9.18.2",
|
||
"versionStartIncluding": "1.9.18",
|
||
"vulnerable": true
|
||
},
|
||
{
|
||
"criteria": "cpe:2.3:a:wso2:org.wso2.carbon.identity.auth.service:*:*:*:*:*:*:*:*",
|
||
"versionEndIncluding": "5.5.2.*",
|
||
"versionStartIncluding": "5.5.2",
|
||
"vulnerable": false
|
||
}
|
||
],
|
||
"negate": false,
|
||
"operator": "OR"
|
||
}
|
||
],
|
||
"operator": "OR"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication.<br><br>Successful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected."
|
||
}
|
||
],
|
||
"value": "A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Due to improper validation of client certificate–based authentication in certain default configurations, the affected components may permit unauthenticated requests even when mTLS is enabled. This condition occurs when relying on the default mTLS settings for System REST APIs or when the mTLS authenticator is enabled for SOAP services, causing these interfaces to accept requests without enforcing additional authentication.\n\nSuccessful exploitation allows a malicious actor with network access to the affected endpoints to gain administrative privileges and perform unauthorized operations. The vulnerability is exploitable only when the impacted mTLS flows are enabled and accessible in a given deployment. Other certificate-based authentication mechanisms such as Mutual TLS OAuth client authentication and X.509 login flows are not affected, and APIs served through the API Gateway of WSO2 API Manager remain unaffected."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "NETWORK",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 9.8,
|
||
"baseSeverity": "CRITICAL",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "NONE",
|
||
"scope": "UNCHANGED",
|
||
"userInteraction": "NONE",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
},
|
||
"format": "CVSS",
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "GENERAL"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-306",
|
||
"description": "CWE-306 Missing Authentication for Critical Function",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
|
||
"shortName": "WSO2",
|
||
"dateUpdated": "2025-11-18T12:49:08.200Z"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"vendor-advisory"
|
||
],
|
||
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4494/"
|
||
}
|
||
],
|
||
"solutions": [
|
||
{
|
||
"lang": "en",
|
||
"supportingMedia": [
|
||
{
|
||
"base64": false,
|
||
"type": "text/html",
|
||
"value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4494/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4494/#solution</span></a> <br>"
|
||
}
|
||
],
|
||
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4494/#solution"
|
||
}
|
||
],
|
||
"source": {
|
||
"advisory": "WSO2-2025-4494",
|
||
"discovery": "INTERNAL"
|
||
},
|
||
"title": "Improper Certificate-Based Authentication Enforcement in Multiple WSO2 Products",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2025-11-18T17:23:36.208499Z",
|
||
"id": "CVE-2025-9312",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "yes"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-11-18T17:38:15.686Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |