5.4

CVE-2025-13394

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions.

An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wso2 ≫ Api Control Plane Version >= 4.5.0 < 4.5.0.39
Wso2 ≫ Api Control Plane Version >= 4.6.0 < 4.6.0.3
Wso2 ≫ Api Manager Version >= 3.1.0 < 3.1.0.352
Wso2 ≫ Api Manager Version >= 3.2.0 < 3.2.0.456
Wso2 ≫ Api Manager Version >= 3.2.1 < 3.2.1.75
Wso2 ≫ Api Manager Version >= 4.0.0 < 4.0.0.376
Wso2 ≫ Api Manager Version >= 4.1.0 < 4.1.0.239
Wso2 ≫ Api Manager Version >= 4.2.0 < 4.2.0.179
Wso2 ≫ Api Manager Version >= 4.3.0 < 4.3.0.91
Wso2 ≫ Api Manager Version >= 4.4.0 < 4.4.0.55
Wso2 ≫ Api Manager Version >= 4.5.0 < 4.5.0.38
Wso2 ≫ Api Manager Version >= 4.6.0 < 4.6.0.3
Wso2 ≫ Enterprise Integrator Version >= 6.6.0 < 6.6.0.227
Wso2 ≫ Identity Server Version >= 5.10.0 < 5.10.0.381
Wso2 ≫ Identity Server Version >= 5.11.0 < 5.11.0.428
Wso2 ≫ Identity Server Version >= 6.0.0 < 6.0.0.255
Wso2 ≫ Identity Server Version >= 6.1.0 < 6.1.0.256
Wso2 ≫ Identity Server Version >= 7.0.0 < 7.0.0.133
Wso2 ≫ Identity Server Version >= 7.1.0 < 7.1.0.41
Wso2 ≫ Identity Server Version >= 7.2.0 < 7.2.0.3
Wso2 ≫ Identity Server As Key Manager Version >= 5.10.0 < 5.10.0.372
Wso2 ≫ Open Banking Am Version >= 2.0.0 < 2.0.0.401
Wso2 ≫ Open Banking Iam Version >= 2.0.0 < 2.0.0.421
Wso2 ≫ Traffic Manager Version >= 4.5.0 < 4.5.0.37
Wso2 ≫ Traffic Manager Version >= 4.6.0 < 4.6.0.3
Wso2 ≫ Universal Gateway Version >= 4.5.0 < 4.5.0.37
Wso2 ≫ Universal Gateway Version >= 4.6.0 < 4.6.0.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.009
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
ed10eef1-636d-4fbe-9993-6890dfa878f8 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/
Vendor Advisory