8.4Alta
CVE-2025-12737Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution
Descripción
The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| wso2 | api control plane | 4.5.0 – < 4.5.0.36 | |
| wso2 | api manager | 3.1.0 – < 3.1.0.349 | |
| wso2 | identity server | 5.10.0 – < 5.10.0.378 | |
| wso2 | identity server as key manager | 5.10.0 – < 5.10.0.369 | |
| wso2 | open banking am | 2.0.0 – < 2.0.0.398 | |
| wso2 | open banking iam | 2.0.0 – < 2.0.0.418 | |
| wso2 | traffic manager | 4.5.0 – < 4.5.0.34 | |
| wso2 | universal gateway | 4.5.0 – < 4.5.0.34 | |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.36, 4.6.0 – < 4.6.0.1 | |
| WSO2 | WSO2 API Manager | 3.1.0 – < 3.1.0.349, 3.2.0 – < 3.2.0.453, 3.2.1 – < 3.2.1.73, 4.0.0 – < 4.0.0.373, 4.1.0 – < 4.1.0.236, 4.2.0 – < 4.2.0.176, 4.3.0 – < 4.3.0.88, 4.4.0 – < 4.4.0.52, 4.5.0 – < 4.5.0.35, 4.6.0 – < 4.6.0.1 | |
| WSO2 | WSO2 Identity Server | 5.10.0 – < 5.10.0.378, 5.11.0 – < 5.11.0.425, 6.0.0 – < 6.0.0.252, 6.1.0 – < 6.1.0.253, 7.0.0 – < 7.0.0.130, 7.1.0 – < 7.1.0.38, 7.2.0 – < 7.2.0.1 | |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 – < 5.10.0.369 | |
| WSO2 | WSO2 Open Banking AM | 2.0.0 – < 2.0.0.398 | |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – < 2.0.0.418 | |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.34, 4.6.0 – < 4.6.0.1 | |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.34, 4.6.0 – < 4.6.0.1 |
Referencias y parches
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4771/ vendor-advisoryPatchVendor Advisory
Coincidencias CPE (NVD) (26)
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.36cpe:2.3:a:wso2:api_control_plane:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.1.0 < 3.1.0.349cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.2.0 < 3.2.0.453cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 3.2.1 < 3.2.1.73cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.0.373cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.236cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.0.176cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.0.88cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.0.52cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.35cpe:2.3:a:wso2:api_manager:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.10.0 < 5.10.0.378cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 5.11.0 < 5.11.0.425cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 6.0.0 < 6.0.0.252cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 6.1.0 < 6.1.0.253cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 7.0.0 < 7.0.0.130cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*≥ 7.1.0 < 7.1.0.38cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*≥ 5.10.0 < 5.10.0.369cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.0.398cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*≥ 2.0.0 < 2.0.0.418cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.34cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.34cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*