6.5

CVE-2025-9804

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs. A low-privileged user may exploit this flaw to perform unauthorized operations, including accessing server-level information.

This vulnerability affects only internal administrative interfaces. APIs exposed through the WSO2 API Manager's API Gateway remain unaffected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wso2 ≫ Api Control Plane Version 4.5.0 Update -
Wso2 ≫ Api Manager Version 2.0.0
Wso2 ≫ Api Manager Version 2.1.0
Wso2 ≫ Api Manager Version 2.2.0
Wso2 ≫ Api Manager Version 2.5.0
Wso2 ≫ Api Manager Version 2.6.0
Wso2 ≫ Api Manager Version 3.0.0
Wso2 ≫ Api Manager Version 3.1.0
Wso2 ≫ Api Manager Version 3.2.0
Wso2 ≫ Api Manager Version 3.2.1
Wso2 ≫ Api Manager Version 4.0.0
Wso2 ≫ Api Manager Version 4.1.0 Update -
Wso2 ≫ Api Manager Version 4.2.0 Update -
Wso2 ≫ Api Manager Version 4.3.0 Update -
Wso2 ≫ Api Manager Version 4.4.0 Update -
Wso2 ≫ Api Manager Version 4.5.0 Update -
Wso2 ≫ Api Manager Analytics Version 2.0.0
Wso2 ≫ Api Manager Analytics Version 2.1.0
Wso2 ≫ Api Manager Analytics Version 2.2.0
Wso2 ≫ Api Manager Analytics Version 2.5.0
Wso2 ≫ Data Analytics Server Version 3.1.0
Wso2 ≫ Data Analytics Server Version 3.2.0
Wso2 ≫ Enterprise Integrator Version 6.2.0
Wso2 ≫ Enterprise Integrator Version 6.3.0
Wso2 ≫ Enterprise Mobility Manager Version 2.2.0
Wso2 ≫ Enterprise Service Bus Version 5.0.0
Wso2 ≫ Identity Server Version 5.2.0
Wso2 ≫ Identity Server Version 5.3.0
Wso2 ≫ Identity Server Version 5.4.0
Wso2 ≫ Identity Server Version 5.4.1
Wso2 ≫ Identity Server Version 5.5.0
Wso2 ≫ Identity Server Version 5.6.0
Wso2 ≫ Identity Server Version 5.7.0
Wso2 ≫ Identity Server Version 5.8.0
Wso2 ≫ Identity Server Version 5.9.0
Wso2 ≫ Identity Server Version 5.10.0
Wso2 ≫ Identity Server Version 5.11.0
Wso2 ≫ Identity Server Version 6.0.0 Update -
Wso2 ≫ Identity Server Version 6.1.0 Update -
Wso2 ≫ Identity Server Version 7.0.0 Update -
Wso2 ≫ Identity Server Version 7.1.0 Update -
Wso2 ≫ Identity Server Analytics Version 5.2.0
Wso2 ≫ Identity Server Analytics Version 5.3.0
Wso2 ≫ Identity Server Analytics Version 5.5.0
Wso2 ≫ Identity Server Analytics Version 5.6.0
Wso2 ≫ Open Banking Am Version 1.4.0
Wso2 ≫ Open Banking Am Version 1.5.0
Wso2 ≫ Open Banking Am Version 2.0.0
Wso2 ≫ Open Banking Iam Version 2.0.0
Wso2 ≫ Open Banking Km Version 1.4.0
Wso2 ≫ Open Banking Km Version 1.5.0
Wso2 ≫ Traffic Manager Version 4.5.0
Wso2 ≫ Universal Gateway Version 4.5.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.52% 0.406
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ed10eef1-636d-4fbe-9993-6890dfa878f8 9.6 2.8 6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4503/
Vendor Advisory