9.1Kritik
CVE-2025-13590Authenticated arbitrary file upload via a System REST API requiring administrator permission.
Açıklama
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code execution. By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by uploading a specially crafted payload.
Zayıflık türü (CWE):
CWE-434
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| wso2 | api control plane | 4.5.0 | |
| wso2 | api manager | 4.2.0 | |
| WSO2 | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl | 9.28.116 – < 9.28.116.391, 9.29.120 – < 9.29.120.210, 9.30.67 – < 9.30.67.133, 9.31.86 – < 9.31.86.100, 9.32.147 – < 9.32.147.2 | |
| wso2 | traffic manager | 4.5.0 | |
| wso2 | universal gateway | 4.5.0 | |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.39, 4.6.0 – < 4.6.0.3 | |
| WSO2 | WSO2 API Manager | 4.2.0 – < 4.2.0.179, 4.3.0 – < 4.3.0.91, 4.4.0 – < 4.4.0.55, 4.5.0 – < 4.5.0.38, 4.6.0 – < 4.6.0.3 | |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.37, 4.6.0 – < 4.6.0.3 | |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.37, 4.6.0 – < 4.6.0.3 |
Kaynaklar ve yamalar
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4849/ vendor-advisoryVendor Advisory
CPE eşleşmeleri (NVD) (11)
cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.6.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*