CVE-2025-5605

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

En bref

Sévérité: MEDIUM 4.3
EPSS: EPSS 0.85 % · centile 58 (2026-10-27)
État: PUBLISHED
Publiée: 2025-10-24
Mise à jour: 2025-10-24
Attribuée par: WSO2
Statut NVD: Analyzed

Description

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	WSO2
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-290

Références européennes

ENISA EUVD · EUVD-2025-35828
GCVE · GCVE-0-2025-5605

Configurations affectées (CPE NVD)

cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
WSO2 · WSO2 Identity Server	unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.361 ; affected 5.11.0 < 5.11.0.414 ; affected 6.0.0 < 6.0.0.245 ; affected 6.1.0 < 6.1.0.244 ; affected 7.0.0 < 7.0.0.119
WSO2 · WSO2 Enterprise Integrator	unknown 0 < 6.6.0 ; affected 6.6.0 < 6.6.0.217
WSO2 · WSO2 Universal Gateway	affected 4.5.0 < 4.5.0.10
WSO2 · WSO2 Traffic Manager	affected 4.5.0 < 4.5.0.10
WSO2 · WSO2 API Manager	unknown 0 < 3.1.0 ; affected 3.1.0 < 3.1.0.334 ; affected 3.2.0 < 3.2.0.430 ; affected 3.2.1 < 3.2.1.48 ; affected 4.0.0 < 4.0.0.346 ; affected 4.1.0 < 4.1.0.210
WSO2 · WSO2 API Control Plane	affected 4.5.0 < 4.5.0.11
WSO2 · WSO2 Identity Server as Key Manager	unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.354
WSO2 · WSO2 Open Banking AM	unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.382
WSO2 · WSO2 Open Banking IAM	unknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.403
WSO2 · org.wso2.carbon:org.wso2.carbon.ui	affected 4.5.3 < 4.5.3.40 ; affected 4.6.0 < 4.6.0.1224 ; affected 4.6.1 < 4.6.1.150 ; affected 4.6.2 < 4.6.2.664 ; affected 4.6.3 < 4.6.3.32 ; affected 4.6.4 < 4.6.4.8

Références

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4115/

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD