CVE-2025-10611 (GCVE-0-2025-10611)
Vulnerability from cvelistv5
Published
2025-10-16 12:09
Modified
2025-10-16 13:34
Severity ?
Summary
Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation. Successful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.
Impacted products
Vendor Product Version
WSO2 WSO2 API Manager Version: 2.1.0   < 2.1.0.42
Version: 2.2.0   < 2.2.0.61
Version: 2.5.0   < 2.5.0.87
Version: 2.6.0   < 2.6.0.148
Version: 3.0.0   < 3.0.0.178
Version: 3.1.0   < 3.1.0.345
Version: 3.2.0   < 3.2.0.446
Version: 3.2.1   < 3.2.1.66
Version: 4.0.0   < 4.0.0.366
Version: 4.1.0   < 4.1.0.228
Version: 4.2.0   < 4.2.0.169
Version: 4.3.0   < 4.3.0.81
Version: 4.4.0   < 4.4.0.45
Version: 4.5.0   < 4.5.0.28
Create a notification for this product.
   WSO2 WSO2 API Control Plane Version: 4.5.0   < 4.5.0.29
Create a notification for this product.
   WSO2 WSO2 Open Banking AM Version: 1.4.0   < 1.4.0.141
Version: 1.5.0   < 1.5.0.142
Version: 2.0.0   < 2.0.0.394
Create a notification for this product.
   WSO2 WSO2 Open Banking IAM Version: 2.0.0   < 2.0.0.414
Create a notification for this product.
   WSO2 WSO2 Identity Server Version: 5.3.0   < 5.3.0.39
Version: 5.5.0   < 5.5.0.54
Version: 5.6.0   < 5.6.0.62
Version: 5.7.0   < 5.7.0.128
Version: 5.8.0   < 5.8.0.112
Version: 5.9.0   < 5.9.0.171
Version: 5.10.0   < 5.10.0.375
Version: 5.11.0   < 5.11.0.419
Version: 6.0.0   < 6.0.0.248
Version: 6.1.0   < 6.1.0.248
Version: 7.0.0   < 7.0.0.124
Version: 7.1.0   < 7.1.0.31
Create a notification for this product.
   WSO2 WSO2 Identity Server as Key Manager Version: 5.3.0   < 5.3.0.44
Version: 5.5.0   < 5.5.0.55
Version: 5.6.0   < 5.6.0.77
Version: 5.7.0   < 5.7.0.127
Version: 5.9.0   < 5.9.0.178
Version: 5.10.0   < 5.10.0.365
Create a notification for this product.
   WSO2 WSO2 Open Banking KM Version: 1.4.0   < 1.4.0.135
Version: 1.5.0   < 1.5.0.125
Create a notification for this product.
   WSO2 WSO2 Universal Gateway Version: 4.5.0   < 4.5.0.27
Create a notification for this product.
   WSO2 WSO2 Traffic Manager Version: 4.5.0   < 4.5.0.27
Create a notification for this product.
   WSO2 org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service Version: 1.1.1   < 1.1.1.7
Version: 1.1.16   < 1.1.16.6
Version: 1.1.18   < 1.1.18.7
Version: 1.1.20   < 1.1.20.9
Version: 1.1.26   < 1.1.26.11
Version: 1.3.6   < 1.3.6.11
Version: 1.4.0   < 1.4.0.21
Version: 1.4.25   < 1.4.25.27
Version: 1.4.52   < 1.4.52.6
Version: 1.6.1   < 1.6.1.12
Version: 1.7.1   < 1.7.1.7
Version: 1.8.11   < 1.8.11.8
Version: 1.8.41   < 1.8.41.4
Version: 1.9.4   < 1.9.4.9
Version: 1.9.18   < 1.9.18.7
Version: 1.8   < 1.8.48
Patch: 1.9.46
Create a notification for this product.
   WSO2 org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve Version: 1.1.1   < 1.1.1.7
Version: 1.1.16   < 1.1.16.6
Version: 1.1.18   < 1.1.18.7
Version: 1.1.20   < 1.1.20.9
Version: 1.1.26   < 1.1.26.11
Version: 1.3.6   < 1.3.6.11
Version: 1.4.0   < 1.4.0.21
Version: 1.4.25   < 1.4.25.27
Version: 1.4.52   < 1.4.52.6
Version: 1.6.1   < 1.6.1.12
Version: 1.7.1   < 1.7.1.7
Version: 1.8.11   < 1.8.11.8
Version: 1.8.41   < 1.8.41.4
Version: 1.9.4   < 1.9.4.9
Version: 1.9.18   < 1.9.18.7
Version: 1.8   < 1.8.48
Patch: 1.9.46
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-10611",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-16T13:24:33.931504Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-863",
                "description": "CWE-863 Incorrect Authorization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-16T13:34:31.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.1.0.42",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.2.0.61",
              "status": "affected",
              "version": "2.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.0.87",
              "status": "affected",
              "version": "2.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.6.0.148",
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.0.0.178",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.345",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.446",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.66",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.366",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.228",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.169",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.81",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.45",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.28",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.29",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.141",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.142",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.394",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.414",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.39",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.54",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.62",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.128",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.8.0.112",
              "status": "affected",
              "version": "5.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.171",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.375",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.419",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.248",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.248",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.124",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.31",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.3.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.3.0.44",
              "status": "affected",
              "version": "5.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.5.0.55",
              "status": "affected",
              "version": "5.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.6.0.77",
              "status": "affected",
              "version": "5.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.7.0.127",
              "status": "affected",
              "version": "5.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.9.0.178",
              "status": "affected",
              "version": "5.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.365",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking KM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.135",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.5.0.125",
              "status": "affected",
              "version": "1.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.27",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.27",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service",
          "product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.1.1.7",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.16.6",
              "status": "affected",
              "version": "1.1.16",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.18.7",
              "status": "affected",
              "version": "1.1.18",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.20.9",
              "status": "affected",
              "version": "1.1.20",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.26.11",
              "status": "affected",
              "version": "1.1.26",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.6.11",
              "status": "affected",
              "version": "1.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.21",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.25.27",
              "status": "affected",
              "version": "1.4.25",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.52.6",
              "status": "affected",
              "version": "1.4.52",
              "versionType": "custom"
            },
            {
              "lessThan": "1.6.1.12",
              "status": "affected",
              "version": "1.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.7.1.7",
              "status": "affected",
              "version": "1.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.11.8",
              "status": "affected",
              "version": "1.8.11",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.41.4",
              "status": "affected",
              "version": "1.8.41",
              "versionType": "custom"
            },
            {
              "lessThan": "1.9.4.9",
              "status": "affected",
              "version": "1.9.4",
              "versionType": "custom"
            },
            {
              "lessThan": "1.9.18.7",
              "status": "affected",
              "version": "1.9.18",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.48",
              "status": "affected",
              "version": "1.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "1.9.46",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve",
          "product": "org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.1.1.7",
              "status": "affected",
              "version": "1.1.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.16.6",
              "status": "affected",
              "version": "1.1.16",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.18.7",
              "status": "affected",
              "version": "1.1.18",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.20.9",
              "status": "affected",
              "version": "1.1.20",
              "versionType": "custom"
            },
            {
              "lessThan": "1.1.26.11",
              "status": "affected",
              "version": "1.1.26",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.6.11",
              "status": "affected",
              "version": "1.3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.0.21",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.25.27",
              "status": "affected",
              "version": "1.4.25",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.52.6",
              "status": "affected",
              "version": "1.4.52",
              "versionType": "custom"
            },
            {
              "lessThan": "1.6.1.12",
              "status": "affected",
              "version": "1.6.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.7.1.7",
              "status": "affected",
              "version": "1.7.1",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.11.8",
              "status": "affected",
              "version": "1.8.11",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.41.4",
              "status": "affected",
              "version": "1.8.41",
              "versionType": "custom"
            },
            {
              "lessThan": "1.9.4.9",
              "status": "affected",
              "version": "1.9.4",
              "versionType": "custom"
            },
            {
              "lessThan": "1.9.18.7",
              "status": "affected",
              "version": "1.9.18",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.48",
              "status": "affected",
              "version": "1.8",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "1.9.46",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\u003cbr\u003e\u003cbr\u003eSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\u003cbr\u003e"
            }
          ],
          "value": "Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\n\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-16T12:09:31.802Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2025-4585",
        "discovery": "INTERNAL"
      },
      "title": "Potential Broken Access Control in Multiple WSO2 Products via System REST APIs",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2025-10611",
    "datePublished": "2025-10-16T12:09:31.802Z",
    "dateReserved": "2025-09-17T08:56:27.794Z",
    "dateUpdated": "2025-10-16T13:34:31.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-10611\",\"sourceIdentifier\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"published\":\"2025-10-16T13:15:40.640\",\"lastModified\":\"2025-11-21T21:38:23.433\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\\n\\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"245D4EB1-F69D-4FAF-94DB-F4B3D3C20539\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6819491F-C6C3-41C1-B27A-0D0B62224977\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D57C8CF-084D-4142-9AF1-7C9F1261A3BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC168B6A-B15A-4C3B-A38D-C0B65F24F333\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8FF14774-8935-4FC9-B5C8-9771B3D6EBFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1344FB79-0796-445C-A8F3-C03E995925D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E31E32CD-497E-4EF5-B3FC-8718EE06EDAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B58251E8-606B-47C8-8E50-9F9FC8C179BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E21D7ABF-C328-425D-B914-618C7628220B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"51465410-6B7C-40FD-A1AB-A14F650A6AC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"851470CC-22AB-43E4-9CC6-5E22D49B3572\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EBAB99E-6F0F-4CE9-A954-E8878826304C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3E6207-B2CF-487C-9CB8-906248B665C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"D47B760D-5418-4FB0-88F0-3F78BAFF63E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0375C318-ECD2-4657-A0D7-4A0708266FBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DA0050E-D5DD-45E5-9F61-DC1BB060EFF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26542F95-73F3-4906-838E-A66F5DC9DFA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60781FE4-38A3-4FEA-9D8B-CADE4B535974\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B169832-A746-49A6-8E92-06624AA9B13A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"981D701D-E381-484A-9614-CD0EF0331071\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4F126CA-A2F9-44F4-968B-DF71765869E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2153AECE-020A-4C01-B2A6-F9F5D98E7EBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA76533A-5BED-4BDC-B348-EB3D3FDFB110\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C1EFBD0F-9664-4EF3-9908-C72B1318F68F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A5358E6E-8C01-408D-8692-B1A326DC630F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"104DBA04-538E-4CC5-9B6C-CFEDB40375AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4F0F121-700C-4D30-BAFC-960DCC56F08B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E5761F7-C287-4EC4-A899-C54FB4E80A35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B184BFC-8E1A-4971-B6D2-C594742AB8CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA51AC1B-0BF6-44F6-B034-CAD4F623DD76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6BB34405-A2F1-461A-B51B-E103BB3680A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_am:1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CFB56F4-91D1-4FBF-842A-04BB117CAF85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_am:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"035BF3B3-1AB9-43BC-BB37-68843818EDEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94347800-04D2-48C4-ACF0-078A5ACBB063\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_km:1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E53783F4-60C7-4A92-8951-F8FD51170670\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:open_banking_km:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"535EFD44-F81C-43B2-B595-81429468637F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C7413107-D7B2-49AE-AC46-52E7BFCD6ED8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"61636553-C25E-44DF-93D7-EB3E1056D1DC\"}]}]}],\"references\":[{\"url\":\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/\",\"source\":\"ed10eef1-636d-4fbe-9993-6890dfa878f8\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-10611\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-16T13:24:33.931504Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-16T13:24:43.729Z\"}}], \"cna\": {\"title\": \"Potential Broken Access Control in Multiple WSO2 Products via System REST APIs\", \"source\": {\"advisory\": \"WSO2-2025-4585\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"WSO2\", \"product\": \"WSO2 API Manager\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"2.1.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.1.0\", \"lessThan\": \"2.1.0.42\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.2.0\", \"lessThan\": \"2.2.0.61\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.5.0\", \"lessThan\": \"2.5.0.87\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.6.0\", \"lessThan\": \"2.6.0.148\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.0.0.178\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.1.0\", \"lessThan\": \"3.1.0.345\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.0\", \"lessThan\": \"3.2.0.446\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"3.2.1\", \"lessThan\": \"3.2.1.66\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.0.0\", \"lessThan\": \"4.0.0.366\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.1.0\", \"lessThan\": \"4.1.0.228\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.2.0\", \"lessThan\": \"4.2.0.169\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.3.0\", \"lessThan\": \"4.3.0.81\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.4.0\", \"lessThan\": \"4.4.0.45\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.28\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 API Control Plane\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.29\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking AM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"1.4.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.141\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.5.0\", \"lessThan\": \"1.5.0.142\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.394\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking IAM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"2.0.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.0.0.414\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Identity Server\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"5.3.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.3.0\", \"lessThan\": \"5.3.0.39\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.5.0\", \"lessThan\": \"5.5.0.54\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.6.0\", \"lessThan\": \"5.6.0.62\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.7.0\", \"lessThan\": \"5.7.0.128\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.8.0\", \"lessThan\": \"5.8.0.112\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.9.0\", \"lessThan\": \"5.9.0.171\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.10.0\", \"lessThan\": \"5.10.0.375\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.11.0\", \"lessThan\": \"5.11.0.419\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.0.0.248\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"6.1.0\", \"lessThan\": \"6.1.0.248\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.0.0\", \"lessThan\": \"7.0.0.124\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"7.1.0\", \"lessThan\": \"7.1.0.31\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Identity Server as Key Manager\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"5.3.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.3.0\", \"lessThan\": \"5.3.0.44\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.5.0\", \"lessThan\": \"5.5.0.55\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.6.0\", \"lessThan\": \"5.6.0.77\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.7.0\", \"lessThan\": \"5.7.0.127\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.9.0\", \"lessThan\": \"5.9.0.178\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"5.10.0\", \"lessThan\": \"5.10.0.365\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Open Banking KM\", \"versions\": [{\"status\": \"unknown\", \"version\": \"0\", \"lessThan\": \"1.4.0\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.135\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.5.0\", \"lessThan\": \"1.5.0.125\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Universal Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.27\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"WSO2 Traffic Manager\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.5.0\", \"lessThan\": \"4.5.0.27\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"WSO2\", \"product\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.1.1\", \"lessThan\": \"1.1.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.16\", \"lessThan\": \"1.1.16.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.18\", \"lessThan\": \"1.1.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.20\", \"lessThan\": \"1.1.20.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.26\", \"lessThan\": \"1.1.26.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.3.6\", \"lessThan\": \"1.3.6.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.21\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.25\", \"lessThan\": \"1.4.25.27\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.52\", \"lessThan\": \"1.4.52.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.6.1\", \"lessThan\": \"1.6.1.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.7.1\", \"lessThan\": \"1.7.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.11\", \"lessThan\": \"1.8.11.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.41\", \"lessThan\": \"1.8.41.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.4\", \"lessThan\": \"1.9.4.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.18\", \"lessThan\": \"1.9.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8\", \"lessThan\": \"1.8.48\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"1.9.46\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"packageName\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.service\", \"defaultStatus\": \"unknown\"}, {\"vendor\": \"WSO2\", \"product\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.1.1\", \"lessThan\": \"1.1.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.16\", \"lessThan\": \"1.1.16.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.18\", \"lessThan\": \"1.1.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.20\", \"lessThan\": \"1.1.20.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.1.26\", \"lessThan\": \"1.1.26.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.3.6\", \"lessThan\": \"1.3.6.11\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.0\", \"lessThan\": \"1.4.0.21\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.25\", \"lessThan\": \"1.4.25.27\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.4.52\", \"lessThan\": \"1.4.52.6\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.6.1\", \"lessThan\": \"1.6.1.12\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.7.1\", \"lessThan\": \"1.7.1.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.11\", \"lessThan\": \"1.8.11.8\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8.41\", \"lessThan\": \"1.8.41.4\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.4\", \"lessThan\": \"1.9.4.9\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.9.18\", \"lessThan\": \"1.9.18.7\", \"versionType\": \"custom\"}, {\"status\": \"affected\", \"version\": \"1.8\", \"lessThan\": \"1.8.48\", \"versionType\": \"custom\"}, {\"status\": \"unaffected\", \"version\": \"1.9.46\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"*\"}], \"packageName\": \"org.wso2.carbon.identity.auth.rest:org.wso2.carbon.identity.auth.valve\", \"defaultStatus\": \"unknown\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: transparent;\\\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\\\"\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4585/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\\n\\nSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be invoked without proper validation.\u003cbr\u003e\u003cbr\u003eSuccessful exploitation of this vulnerability could lead to a malicious actor gaining administrative access and performing unauthenticated and unauthorized administrative operations.\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"shortName\": \"WSO2\", \"dateUpdated\": \"2025-10-16T12:09:31.802Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-10611\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-16T13:34:31.799Z\", \"dateReserved\": \"2025-09-17T08:56:27.794Z\", \"assignerOrgId\": \"ed10eef1-636d-4fbe-9993-6890dfa878f8\", \"datePublished\": \"2025-10-16T12:09:31.802Z\", \"assignerShortName\": \"WSO2\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…