Refine your search

4 vulnerabilities found for identity_server_analytics by wso2

CVE-2025-9804 (GCVE-0-2025-9804)
Vulnerability from nvd
Published
2025-10-16 12:33
Modified
2025-10-17 16:01
Summary
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Impacted products
Vendor Product Version
WSO2 WSO2 Identity Server as Key Manager Version: 5.3.0   < 5.3.0.41
Version: 5.5.0   < 5.5.0.53
Version: 5.6.0   < 5.6.0.75
Version: 5.7.0   < 5.7.0.125
Version: 5.9.0   < 5.9.0.176
Version: 5.10.0   < 5.10.0.359
Create a notification for this product.
   WSO2 WSO2 Identity Server Version: 5.2.0   < 5.2.0.34
Version: 5.3.0   < 5.3.0.36
Version: 5.4.0   < 5.4.0.34
Version: 5.4.1   < 5.4.1.38
Version: 5.5.0   < 5.5.0.52
Version: 5.6.0   < 5.6.0.60
Version: 5.7.0   < 5.7.0.126
Version: 5.8.0   < 5.8.0.110
Version: 5.9.0   < 5.9.0.169
Version: 5.10.0   < 5.10.0.369
Version: 5.11.0   < 5.11.0.413
Version: 6.0.0   < 6.0.0.244
Version: 6.1.0   < 6.1.0.243
Version: 7.0.0   < 7.0.0.118
Version: 7.1.0   < 7.1.0.25
Create a notification for this product.
   WSO2 WSO2 Open Banking KM Version: 1.4.0   < 1.4.0.133
Version: 1.5.0   < 1.5.0.123
Create a notification for this product.
   WSO2 WSO2 Open Banking IAM Version: 2.0.0   < 2.0.0.409
Create a notification for this product.
   WSO2 WSO2 Open Banking AM Version: 1.4.0   < 1.4.0.139
Version: 1.5.0   < 1.5.0.140
Version: 2.0.0   < 2.0.0.389
Create a notification for this product.
   WSO2 WSO2 API Manager Version: 2.0.0   < 2.0.0.31
Version: 2.1.0   < 2.1.0.40
Version: 2.2.0   < 2.2.0.59
Version: 2.5.0   < 2.5.0.85
Version: 2.6.0   < 2.6.0.146
Version: 3.0.0   < 3.0.0.176
Version: 3.1.0   < 3.1.0.340
Version: 3.2.0   < 3.2.0.441
Version: 3.2.1   < 3.2.1.61
Version: 4.0.0   < 4.0.0.361
Version: 4.1.0   < 4.1.0.224
Version: 4.2.0   < 4.2.0.162
Version: 4.3.0   < 4.3.0.75
Version: 4.4.0   < 4.4.0.39
Version: 4.5.0   < 4.5.0.23
Create a notification for this product.
   WSO2 WSO2 Identity Server Analytics Version: 5.2.0   < 5.2.0.19
Version: 5.3.0   < 5.3.0.17
Version: 5.5.0   < 5.5.0.31
Version: 5.6.0   < 5.6.0.38
Create a notification for this product.
   WSO2 API Manager Analytics Version: 2.0.0   < 2.0.0.14
Version: 2.1.0   < 2.1.0.19
Version: 2.2.0   < 2.2.0.30
Version: 2.5.0   < 2.5.0.39
Create a notification for this product.
   WSO2 WSO2 Enterprise Integrator Version: 6.2.0   < 6.2.0.62
Version: 6.3.0   < 6.3.0.70
Create a notification for this product.
   WSO2 WSO2 Enterprise Service Bus Analytics Version: 5.0.0   < 5.0.0.13
Create a notification for this product.
   WSO2 WSO2 Data Analytics Server Version: 3.1.0   < 3.1.0.20
Version: 3.2.0   < 3.2.0.33
Create a notification for this product.
   WSO2 WSO2 Enterprise Mobility Manager Version: 2.2.0   < 2.2.0.28
Create a notification for this product.
   WSO2 WSO2 Universal Gateway Version: 4.5.0   < 4.5.0.22
Create a notification for this product.
   WSO2 WSO2 API Control Plane Version: 4.5.0   < 4.5.0.24
Create a notification for this product.
   WSO2 WSO2 Traffic Manager Version: 4.5.0   < 4.5.0.22
Create a notification for this product.
   WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector Version: 2.0.10   < 2.0.10.1
Version: 2.0.15   < 2.0.15.1
Version: 2.0.21   < 2.0.21.1
Version: 2.0.22   < 2.0.22.1
Version: 2.1.12   < 2.1.12.1
Version: 2.1   < 2.1.1972
Version: 2.2   < 2.2.24
Version: 2.2   < 2.2.25
Version: 3.1.0   < 3.1.0.74
Version: 3.3.6   < 3.3.6.7
Version: 3.3.26   < 3.3.26.2
Version: 3.3.35   < 3.3.35.1
Patch: 3.3.41
Create a notification for this product.
   WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util Version: 6.7.206   < 6.7.206.567
Version: 6.7.210   < 6.7.210.63
Version: 9.0.174   < 9.0.174.522
Version: 9.20.74   < 9.20.74.379
Version: 9.28.116   < 9.28.116.360
Version: 9.29.120   < 9.29.120.184
Version: 9.30.67   < 9.30.67.109
Version: 9.31.86   < 9.31.86.71
Patch: 9.32.133
Create a notification for this product.
   WSO2 org.wso2.carbon:org.wso2.carbon.base Version: 4.4.7   < 4.4.7.6
Version: 4.4.9   < 4.4.9.11
Version: 4.4.11   < 4.4.11.9
Version: 4.4.26   < 4.4.26.12
Version: 4.4.35   < 4.4.35.44
Version: 4.5.1   < 4.5.1.43
Version: 4.6.0   < 4.6.0.1990
Version: 4.6.1   < 4.6.1.149
Version: 4.6.2   < 4.6.2.667
Version: 4.6.3   < 4.6.3.36
Version: 4.6.4   < 4.6.4.14
Version: 4.7.1   < 4.7.1.68
Version: 4.8.1   < 4.8.1.39
Version: 4.9.0   < 4.9.0.99
Version: 4.9.26   < 4.9.26.25
Version: 4.9.27   < 4.9.27.10
Version: 4.9.28   < 4.9.28.11
Version: 4.10.9   < 4.10.9.66
Version: 4.10.42   < 4.10.42.9
Version: 4.9   < 4.9.29
Version: 4.10   < 4.10.94
Create a notification for this product.
   WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt Version: 5.2.0   < 5.2.0.4
Version: 5.2.2   < 5.2.2.21
Version: 5.7.5   < 5.7.5.18
Version: 5.11.148   < 5.11.148.19
Version: 5.11.256   < 5.11.256.21
Version: 5.12.153   < 5.12.153.63
Version: 5.12.387   < 5.12.387.46
Version: 5.14.97   < 5.14.97.89
Version: 5.17.5   < 5.17.5.317
Version: 5.17.118   < 5.17.118.17
Version: 5.18.187   < 5.18.187.309
Version: 5.18.248   < 5.18.248.30
Version: 5.23.8   < 5.23.8.207
Version: 5.24.8   < 5.24.8.23
Version: 5.25.92   < 5.25.92.152
Version: 5.25.705   < 5.25.705.19
Version: 5.25.713   < 5.25.713.9
Version: 5.25.724   < 5.25.724.3
Version: 7.0.78   < 7.0.78.133
Version: 7.8.23   < 7.8.23.47
Version: 5.25   < 5.25.734
Patch: 7.8.489
Create a notification for this product.
   WSO2 org.wso2.carbon:org.wso2.carbon.server.admin Version: 4.4.7   < 4.4.7.6
Version: 4.4.9   < 4.4.9.11
Version: 4.4.11   < 4.4.11.9
Version: 4.4.26   < 4.4.26.12
Version: 4.4.32   < 4.4.32.16
Version: 4.4.35   < 4.4.35.44
Version: 4.5.1   < 4.5.1.43
Version: 4.6.0   < 4.6.0.1990
Version: 4.6.1   < 4.6.1.149
Version: 4.6.2   < 4.6.2.667
Version: 4.6.3   < 4.6.3.36
Version: 4.6.4   < 4.6.4.14
Version: 4.7.1   < 4.7.1.68
Version: 4.8.1   < 4.8.1.39
Version: 4.9.0   < 4.9.0.99
Version: 4.9.26   < 4.9.26.25
Version: 4.9.27   < 4.9.27.10
Version: 4.9.28   < 4.9.28.11
Version: 4.10.9   < 4.10.9.66
Version: 4.10.42   < 4.10.42.9
Version: 4.9   < 4.9.29
Version: 4.10   < 4.10.94
Create a notification for this product.
   WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow Version: 5.1.1   < 5.1.1.1
Version: 5.1.2   < 5.1.2.1
Version: 5.1.5   < 5.1.5.1
Version: 5.3.3   < 5.3.3.1
Version: 5.4.0   < 5.4.0.4
Version: 5.4.1   < 5.4.1.5
Version: 5.6.0   < 5.6.0.1
Patch: 5.6.21
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T13:20:20.582589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-17T16:01:25.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.41",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.53",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.75",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.125",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.176",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.359",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.34",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.36",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.34",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.38",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.52",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.60",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.126",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.0.110",
              "status": "affected",
              "version": "5.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.169",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.369",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.413",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.244",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.243",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.118",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.25",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking KM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.133",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.123",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.409",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.139",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.140",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.389",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.31",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.40",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.59",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.85",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.6.0.146",
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.0.176",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.340",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.441",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.61",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.361",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.224",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.162",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.75",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.39",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.23",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.19",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.17",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.31",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.38",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "API Manager Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.14",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.19",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.30",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.39",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.0.62",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.0.70",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Service Bus Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.0.13",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Data Analytics Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.20",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.33",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Mobility Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.28",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.24",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "product": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.10.1",
              "status": "affected",
              "version": "2.0.10",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.15.1",
              "status": "affected",
              "version": "2.0.15",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.21.1",
              "status": "affected",
              "version": "2.0.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.22.1",
              "status": "affected",
              "version": "2.0.22",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.12.1",
              "status": "affected",
              "version": "2.1.12",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.1972",
              "status": "affected",
              "version": "2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.24",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.25",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.74",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.6.7",
              "status": "affected",
              "version": "3.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.26.2",
              "status": "affected",
              "version": "3.3.26",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.35.1",
              "status": "affected",
              "version": "3.3.35",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "3.3.41",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "product": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.7.206.567",
              "status": "affected",
              "version": "6.7.206",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.210.63",
              "status": "affected",
              "version": "6.7.210",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.174.522",
              "status": "affected",
              "version": "9.0.174",
              "versionType": "custom"
            },
            {
              "lessThan": "9.20.74.379",
              "status": "affected",
              "version": "9.20.74",
              "versionType": "custom"
            },
            {
              "lessThan": "9.28.116.360",
              "status": "affected",
              "version": "9.28.116",
              "versionType": "custom"
            },
            {
              "lessThan": "9.29.120.184",
              "status": "affected",
              "version": "9.29.120",
              "versionType": "custom"
            },
            {
              "lessThan": "9.30.67.109",
              "status": "affected",
              "version": "9.30.67",
              "versionType": "custom"
            },
            {
              "lessThan": "9.31.86.71",
              "status": "affected",
              "version": "9.31.86",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "9.32.133",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.base",
          "product": "org.wso2.carbon:org.wso2.carbon.base",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "product": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0.4",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.2.21",
              "status": "affected",
              "version": "5.2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.5.18",
              "status": "affected",
              "version": "5.7.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.148.19",
              "status": "affected",
              "version": "5.11.148",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.256.21",
              "status": "affected",
              "version": "5.11.256",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.153.63",
              "status": "affected",
              "version": "5.12.153",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.387.46",
              "status": "affected",
              "version": "5.12.387",
              "versionType": "custom"
            },
            {
              "lessThan": "5.14.97.89",
              "status": "affected",
              "version": "5.14.97",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.317",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.17",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.309",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.30",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.207",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.23",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.152",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.19",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.9",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.3",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.133",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.47",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.734",
              "status": "affected",
              "version": "5.25",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.8.489",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "product": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.32.16",
              "status": "affected",
              "version": "4.4.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "product": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.1.1.1",
              "status": "affected",
              "version": "5.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.2.1",
              "status": "affected",
              "version": "5.1.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.5.1",
              "status": "affected",
              "version": "5.1.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.3.1",
              "status": "affected",
              "version": "5.3.3",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.4",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.5",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.1",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.6.21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "crnkovi\u0107"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\u003cbr\u003e\u003cbr\u003eThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected.\u003cbr\u003e"
            }
          ],
          "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 API Manager"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 Identity Server"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T12:33:45.426Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2025-4503",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2025-9804",
    "datePublished": "2025-10-16T12:33:45.426Z",
    "dateReserved": "2025-09-01T13:11:12.678Z",
    "dateUpdated": "2025-10-17T16:01:25.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-29464 (GCVE-0-2022-29464)
Vulnerability from nvd
Published
2022-04-18 00:00
Modified
2025-10-21 23:15
Severity ?
CWE
  • n/a
Summary
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:26:05.175Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20220422 CVE-2022-29464 :: WSO2 Unrestricted arbitrary file upload, and remote code to execution vulnerability.",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/04/22/7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/hakivvi/CVE-2022-29464"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-29464",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T20:50:06.735704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-04-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:15:41.688Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-04-25T00:00:00+00:00",
            "value": "CVE-2022-29464 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-23T21:51:05.905Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20220422 CVE-2022-29464 :: WSO2 Unrestricted arbitrary file upload, and remote code to execution vulnerability.",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/04/22/7"
        },
        {
          "url": "https://github.com/hakivvi/CVE-2022-29464"
        },
        {
          "url": "http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html"
        },
        {
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-29464",
    "datePublished": "2022-04-18T00:00:00.000Z",
    "dateReserved": "2022-04-18T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:15:41.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-9804 (GCVE-0-2025-9804)
Vulnerability from cvelistv5
Published
2025-10-16 12:33
Modified
2025-10-17 16:01
Summary
An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information. This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Impacted products
Vendor Product Version
WSO2 WSO2 Identity Server as Key Manager Version: 5.3.0   < 5.3.0.41
Version: 5.5.0   < 5.5.0.53
Version: 5.6.0   < 5.6.0.75
Version: 5.7.0   < 5.7.0.125
Version: 5.9.0   < 5.9.0.176
Version: 5.10.0   < 5.10.0.359
Create a notification for this product.
   WSO2 WSO2 Identity Server Version: 5.2.0   < 5.2.0.34
Version: 5.3.0   < 5.3.0.36
Version: 5.4.0   < 5.4.0.34
Version: 5.4.1   < 5.4.1.38
Version: 5.5.0   < 5.5.0.52
Version: 5.6.0   < 5.6.0.60
Version: 5.7.0   < 5.7.0.126
Version: 5.8.0   < 5.8.0.110
Version: 5.9.0   < 5.9.0.169
Version: 5.10.0   < 5.10.0.369
Version: 5.11.0   < 5.11.0.413
Version: 6.0.0   < 6.0.0.244
Version: 6.1.0   < 6.1.0.243
Version: 7.0.0   < 7.0.0.118
Version: 7.1.0   < 7.1.0.25
Create a notification for this product.
   WSO2 WSO2 Open Banking KM Version: 1.4.0   < 1.4.0.133
Version: 1.5.0   < 1.5.0.123
Create a notification for this product.
   WSO2 WSO2 Open Banking IAM Version: 2.0.0   < 2.0.0.409
Create a notification for this product.
   WSO2 WSO2 Open Banking AM Version: 1.4.0   < 1.4.0.139
Version: 1.5.0   < 1.5.0.140
Version: 2.0.0   < 2.0.0.389
Create a notification for this product.
   WSO2 WSO2 API Manager Version: 2.0.0   < 2.0.0.31
Version: 2.1.0   < 2.1.0.40
Version: 2.2.0   < 2.2.0.59
Version: 2.5.0   < 2.5.0.85
Version: 2.6.0   < 2.6.0.146
Version: 3.0.0   < 3.0.0.176
Version: 3.1.0   < 3.1.0.340
Version: 3.2.0   < 3.2.0.441
Version: 3.2.1   < 3.2.1.61
Version: 4.0.0   < 4.0.0.361
Version: 4.1.0   < 4.1.0.224
Version: 4.2.0   < 4.2.0.162
Version: 4.3.0   < 4.3.0.75
Version: 4.4.0   < 4.4.0.39
Version: 4.5.0   < 4.5.0.23
Create a notification for this product.
   WSO2 WSO2 Identity Server Analytics Version: 5.2.0   < 5.2.0.19
Version: 5.3.0   < 5.3.0.17
Version: 5.5.0   < 5.5.0.31
Version: 5.6.0   < 5.6.0.38
Create a notification for this product.
   WSO2 API Manager Analytics Version: 2.0.0   < 2.0.0.14
Version: 2.1.0   < 2.1.0.19
Version: 2.2.0   < 2.2.0.30
Version: 2.5.0   < 2.5.0.39
Create a notification for this product.
   WSO2 WSO2 Enterprise Integrator Version: 6.2.0   < 6.2.0.62
Version: 6.3.0   < 6.3.0.70
Create a notification for this product.
   WSO2 WSO2 Enterprise Service Bus Analytics Version: 5.0.0   < 5.0.0.13
Create a notification for this product.
   WSO2 WSO2 Data Analytics Server Version: 3.1.0   < 3.1.0.20
Version: 3.2.0   < 3.2.0.33
Create a notification for this product.
   WSO2 WSO2 Enterprise Mobility Manager Version: 2.2.0   < 2.2.0.28
Create a notification for this product.
   WSO2 WSO2 Universal Gateway Version: 4.5.0   < 4.5.0.22
Create a notification for this product.
   WSO2 WSO2 API Control Plane Version: 4.5.0   < 4.5.0.24
Create a notification for this product.
   WSO2 WSO2 Traffic Manager Version: 4.5.0   < 4.5.0.22
Create a notification for this product.
   WSO2 org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector Version: 2.0.10   < 2.0.10.1
Version: 2.0.15   < 2.0.15.1
Version: 2.0.21   < 2.0.21.1
Version: 2.0.22   < 2.0.22.1
Version: 2.1.12   < 2.1.12.1
Version: 2.1   < 2.1.1972
Version: 2.2   < 2.2.24
Version: 2.2   < 2.2.25
Version: 3.1.0   < 3.1.0.74
Version: 3.3.6   < 3.3.6.7
Version: 3.3.26   < 3.3.26.2
Version: 3.3.35   < 3.3.35.1
Patch: 3.3.41
Create a notification for this product.
   WSO2 org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util Version: 6.7.206   < 6.7.206.567
Version: 6.7.210   < 6.7.210.63
Version: 9.0.174   < 9.0.174.522
Version: 9.20.74   < 9.20.74.379
Version: 9.28.116   < 9.28.116.360
Version: 9.29.120   < 9.29.120.184
Version: 9.30.67   < 9.30.67.109
Version: 9.31.86   < 9.31.86.71
Patch: 9.32.133
Create a notification for this product.
   WSO2 org.wso2.carbon:org.wso2.carbon.base Version: 4.4.7   < 4.4.7.6
Version: 4.4.9   < 4.4.9.11
Version: 4.4.11   < 4.4.11.9
Version: 4.4.26   < 4.4.26.12
Version: 4.4.35   < 4.4.35.44
Version: 4.5.1   < 4.5.1.43
Version: 4.6.0   < 4.6.0.1990
Version: 4.6.1   < 4.6.1.149
Version: 4.6.2   < 4.6.2.667
Version: 4.6.3   < 4.6.3.36
Version: 4.6.4   < 4.6.4.14
Version: 4.7.1   < 4.7.1.68
Version: 4.8.1   < 4.8.1.39
Version: 4.9.0   < 4.9.0.99
Version: 4.9.26   < 4.9.26.25
Version: 4.9.27   < 4.9.27.10
Version: 4.9.28   < 4.9.28.11
Version: 4.10.9   < 4.10.9.66
Version: 4.10.42   < 4.10.42.9
Version: 4.9   < 4.9.29
Version: 4.10   < 4.10.94
Create a notification for this product.
   WSO2 org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt Version: 5.2.0   < 5.2.0.4
Version: 5.2.2   < 5.2.2.21
Version: 5.7.5   < 5.7.5.18
Version: 5.11.148   < 5.11.148.19
Version: 5.11.256   < 5.11.256.21
Version: 5.12.153   < 5.12.153.63
Version: 5.12.387   < 5.12.387.46
Version: 5.14.97   < 5.14.97.89
Version: 5.17.5   < 5.17.5.317
Version: 5.17.118   < 5.17.118.17
Version: 5.18.187   < 5.18.187.309
Version: 5.18.248   < 5.18.248.30
Version: 5.23.8   < 5.23.8.207
Version: 5.24.8   < 5.24.8.23
Version: 5.25.92   < 5.25.92.152
Version: 5.25.705   < 5.25.705.19
Version: 5.25.713   < 5.25.713.9
Version: 5.25.724   < 5.25.724.3
Version: 7.0.78   < 7.0.78.133
Version: 7.8.23   < 7.8.23.47
Version: 5.25   < 5.25.734
Patch: 7.8.489
Create a notification for this product.
   WSO2 org.wso2.carbon:org.wso2.carbon.server.admin Version: 4.4.7   < 4.4.7.6
Version: 4.4.9   < 4.4.9.11
Version: 4.4.11   < 4.4.11.9
Version: 4.4.26   < 4.4.26.12
Version: 4.4.32   < 4.4.32.16
Version: 4.4.35   < 4.4.35.44
Version: 4.5.1   < 4.5.1.43
Version: 4.6.0   < 4.6.0.1990
Version: 4.6.1   < 4.6.1.149
Version: 4.6.2   < 4.6.2.667
Version: 4.6.3   < 4.6.3.36
Version: 4.6.4   < 4.6.4.14
Version: 4.7.1   < 4.7.1.68
Version: 4.8.1   < 4.8.1.39
Version: 4.9.0   < 4.9.0.99
Version: 4.9.26   < 4.9.26.25
Version: 4.9.27   < 4.9.27.10
Version: 4.9.28   < 4.9.28.11
Version: 4.10.9   < 4.10.9.66
Version: 4.10.42   < 4.10.42.9
Version: 4.9   < 4.9.29
Version: 4.10   < 4.10.94
Create a notification for this product.
   WSO2 org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow Version: 5.1.1   < 5.1.1.1
Version: 5.1.2   < 5.1.2.1
Version: 5.1.5   < 5.1.5.1
Version: 5.3.3   < 5.3.3.1
Version: 5.4.0   < 5.4.0.4
Version: 5.4.1   < 5.4.1.5
Version: 5.6.0   < 5.6.0.1
Patch: 5.6.21
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-9804",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T13:20:20.582589Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-17T16:01:25.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.41",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.53",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.75",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.125",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.176",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.359",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.34",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.36",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.34",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.38",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.52",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.60",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.126",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.0.110",
              "status": "affected",
              "version": "5.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.169",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.369",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.413",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.244",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.243",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.118",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.25",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking KM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.133",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.123",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.409",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.139",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.140",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.389",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.31",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.40",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.59",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.85",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.6.0.146",
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.0.176",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.340",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.441",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.61",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.361",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.224",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.162",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.75",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.39",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.23",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.0.19",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.17",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.31",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.38",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "API Manager Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.14",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.19",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.30",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.39",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.2.0.62",
              "status": "affected",
              "version": "6.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.0.70",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Service Bus Analytics",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.0.0.13",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Data Analytics Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.20",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.33",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Mobility Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.28",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.24",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.22",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "product": "org.wso2.carbon.extension.identity.authenticator.outbound.totp:org.wso2.carbon.extension.identity.authenticator.totp.connector",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.10.1",
              "status": "affected",
              "version": "2.0.10",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.15.1",
              "status": "affected",
              "version": "2.0.15",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.21.1",
              "status": "affected",
              "version": "2.0.21",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.22.1",
              "status": "affected",
              "version": "2.0.22",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.12.1",
              "status": "affected",
              "version": "2.1.12",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.1972",
              "status": "affected",
              "version": "2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.24",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.25",
              "status": "affected",
              "version": "2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.74",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.6.7",
              "status": "affected",
              "version": "3.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.26.2",
              "status": "affected",
              "version": "3.3.26",
              "versionType": "custom"
            },
            {
              "lessThan": "3.3.35.1",
              "status": "affected",
              "version": "3.3.35",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "3.3.41",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "product": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.util",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.7.206.567",
              "status": "affected",
              "version": "6.7.206",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.210.63",
              "status": "affected",
              "version": "6.7.210",
              "versionType": "custom"
            },
            {
              "lessThan": "9.0.174.522",
              "status": "affected",
              "version": "9.0.174",
              "versionType": "custom"
            },
            {
              "lessThan": "9.20.74.379",
              "status": "affected",
              "version": "9.20.74",
              "versionType": "custom"
            },
            {
              "lessThan": "9.28.116.360",
              "status": "affected",
              "version": "9.28.116",
              "versionType": "custom"
            },
            {
              "lessThan": "9.29.120.184",
              "status": "affected",
              "version": "9.29.120",
              "versionType": "custom"
            },
            {
              "lessThan": "9.30.67.109",
              "status": "affected",
              "version": "9.30.67",
              "versionType": "custom"
            },
            {
              "lessThan": "9.31.86.71",
              "status": "affected",
              "version": "9.31.86",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "9.32.133",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.base",
          "product": "org.wso2.carbon:org.wso2.carbon.base",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "product": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.mgt",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.2.0.4",
              "status": "affected",
              "version": "5.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.2.2.21",
              "status": "affected",
              "version": "5.2.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.5.18",
              "status": "affected",
              "version": "5.7.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.148.19",
              "status": "affected",
              "version": "5.11.148",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.256.21",
              "status": "affected",
              "version": "5.11.256",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.153.63",
              "status": "affected",
              "version": "5.12.153",
              "versionType": "custom"
            },
            {
              "lessThan": "5.12.387.46",
              "status": "affected",
              "version": "5.12.387",
              "versionType": "custom"
            },
            {
              "lessThan": "5.14.97.89",
              "status": "affected",
              "version": "5.14.97",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.317",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.17",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.309",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.30",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.207",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.23",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.152",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.19",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.9",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.724.3",
              "status": "affected",
              "version": "5.25.724",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.133",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThan": "7.8.23.47",
              "status": "affected",
              "version": "7.8.23",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.734",
              "status": "affected",
              "version": "5.25",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.8.489",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "product": "org.wso2.carbon:org.wso2.carbon.server.admin",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.4.7.6",
              "status": "affected",
              "version": "4.4.7",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.9.11",
              "status": "affected",
              "version": "4.4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.11.9",
              "status": "affected",
              "version": "4.4.11",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.26.12",
              "status": "affected",
              "version": "4.4.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.32.16",
              "status": "affected",
              "version": "4.4.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.35.44",
              "status": "affected",
              "version": "4.4.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.1.43",
              "status": "affected",
              "version": "4.5.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.0.1990",
              "status": "affected",
              "version": "4.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.1.149",
              "status": "affected",
              "version": "4.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.2.667",
              "status": "affected",
              "version": "4.6.2",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.3.36",
              "status": "affected",
              "version": "4.6.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.6.4.14",
              "status": "affected",
              "version": "4.6.4",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.1.68",
              "status": "affected",
              "version": "4.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.1.39",
              "status": "affected",
              "version": "4.8.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.0.99",
              "status": "affected",
              "version": "4.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.26.25",
              "status": "affected",
              "version": "4.9.26",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.27.10",
              "status": "affected",
              "version": "4.9.27",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.28.11",
              "status": "affected",
              "version": "4.9.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.9.66",
              "status": "affected",
              "version": "4.10.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.42.9",
              "status": "affected",
              "version": "4.10.42",
              "versionType": "custom"
            },
            {
              "lessThan": "4.9.29",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.10.94",
              "status": "affected",
              "version": "4.10",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "product": "org.wso2.carbon.identity.workflow.user:org.wso2.carbon.user.mgt.workflow",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.1.1.1",
              "status": "affected",
              "version": "5.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.2.1",
              "status": "affected",
              "version": "5.1.2",
              "versionType": "custom"
            },
            {
              "lessThan": "5.1.5.1",
              "status": "affected",
              "version": "5.1.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.3.1",
              "status": "affected",
              "version": "5.3.3",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.0.4",
              "status": "affected",
              "version": "5.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.4.1.5",
              "status": "affected",
              "version": "5.4.1",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.1",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.6.21",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "crnkovi\u0107"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\u003cbr\u003e\u003cbr\u003eThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected.\u003cbr\u003e"
            }
          ],
          "value": "An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.\n\nThis vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager\u0027s API Gateway remain unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 API Manager"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "For WSO2 Identity Server"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T12:33:45.426Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2025-4503",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2025-9804",
    "datePublished": "2025-10-16T12:33:45.426Z",
    "dateReserved": "2025-09-01T13:11:12.678Z",
    "dateUpdated": "2025-10-17T16:01:25.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-29464 (GCVE-0-2022-29464)
Vulnerability from cvelistv5
Published
2022-04-18 00:00
Modified
2025-10-21 23:15
Severity ?
CWE
  • n/a
Summary
Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:26:05.175Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[oss-security] 20220422 CVE-2022-29464 :: WSO2 Unrestricted arbitrary file upload, and remote code to execution vulnerability.",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/04/22/7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/hakivvi/CVE-2022-29464"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-29464",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T20:50:06.735704Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2022-04-25",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:15:41.688Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29464"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2022-04-25T00:00:00+00:00",
            "value": "CVE-2022-29464 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-23T21:51:05.905Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[oss-security] 20220422 CVE-2022-29464 :: WSO2 Unrestricted arbitrary file upload, and remote code to execution vulnerability.",
          "tags": [
            "mailing-list"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/04/22/7"
        },
        {
          "url": "https://github.com/hakivvi/CVE-2022-29464"
        },
        {
          "url": "http://packetstormsecurity.com/files/166921/WSO-Arbitrary-File-Upload-Remote-Code-Execution.html"
        },
        {
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1738/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2022-29464",
    "datePublished": "2022-04-18T00:00:00.000Z",
    "dateReserved": "2022-04-18T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:15:41.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}