Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2025-13394

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.381affected
  • 5.11.0 to < 5.11.0.428affected
  • 6.0.0 to < 6.0.0.255affected
  • 6.1.0 to < 6.1.0.256affected
  • 7.0.0 to < 7.0.0.133affected
  • 7.1.0 to < 7.1.0.41affected
  • 7.2.0 to < 7.2.0.3affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.352affected
  • 3.2.0 to < 3.2.0.456affected
  • 3.2.1 to < 3.2.1.75affected
  • 4.0.0 to < 4.0.0.376affected
  • 4.1.0 to < 4.1.0.239affected
  • 4.2.0 to < 4.2.0.179affected
  • 4.3.0 to < 4.3.0.91affected
  • 4.4.0 to < 4.4.0.55affected
  • 4.5.0 to < 4.5.0.38affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.421affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.401affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.372affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.39affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.37affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 0 to < 4.5.0unknown
  • 4.5.0 to < 4.5.0.37affected
  • 4.6.0 to < 4.6.0.3affected

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.227affected

WSO2 WSO2 Carbon Identity Entitlement UI

Default version status: unknown

  • 5.17.5 to < 5.17.5.331affected
  • 5.18.187 to < 5.18.187.329affected
  • 5.23.8 to < 5.23.8.210affected
  • 5.25.92 to < 5.25.92.166affected
  • 7.0.78 to < 7.0.78.157affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Identity Management UI1

Default version status: unknown

  • 5.17.5 to < 5.17.5.330affected
  • 5.17.5 to < 5.17.5.331affected
  • 5.17.118 to < 5.17.118.22affected
  • 5.18.187 to < 5.18.187.328affected
  • 5.18.187 to < 5.18.187.329affected
  • 5.18.248 to < 5.18.248.31affected
  • 5.23.8 to < 5.23.8.210affected
  • 5.24.8 to < 5.24.8.26affected
  • 5.25.92 to < 5.25.92.166affected
  • 5.25.705 to < 5.25.705.21affected
  • 5.25.713 to < 5.25.713.10affected
  • 5.25.724 to < 5.25.724.5affected
  • 5.25.736 to < 5.25.736.1affected
  • 7.0.78 to < 7.0.78.157affected
  • 7.8.23 to < 7.8.23.67affected
  • 7.8.586 to < 7.8.586.7affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Identity User Store Configuration UI

Default version status: unknown

  • 5.14.127 to < 5.14.127.13affected
  • 5.17.5 to < 5.17.5.330affected
  • 5.17.5 to < 5.17.5.331affected
  • 5.17.118 to < 5.17.118.22affected
  • 5.18.187 to < 5.18.187.328affected
  • 5.18.187 to < 5.18.187.329affected
  • 5.18.248 to < 5.18.248.31affected
  • 5.23.8 to < 5.23.8.210affected
  • 5.24.8 to < 5.24.8.26affected
  • 5.25.92 to < 5.25.92.166affected
  • 5.25.705 to < 5.25.705.21affected
  • 5.25.713 to < 5.25.713.10affected
  • 5.25.724 to < 5.25.724.5affected
  • 5.25.736 to < 5.25.736.1affected
  • 7.0.78 to < 7.0.78.157affected
  • 7.8.23 to < 7.8.23.67affected
  • 7.8.586 to < 7.8.586.7affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Registry Profiles UI

Default version status: unknown

  • 4.7.32 to < 4.7.32.18affected
  • 4.7.33 to < 4.7.33.16affected
  • 4.8.9 to < 4.8.9.16affected
  • 4.8.12 to < 4.8.12.8affected
  • 4.8.24 to < 4.8.24.6affected
  • 4.8.43 to < 4.8.43.4affected
  • 4.8.50 to < 4.8.50.3affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Registry Properties UI

Default version status: unknown

  • 4.7.24 to < 4.7.24.11affected
  • 4.7.32 to < 4.7.32.16affected
  • 4.7.32 to < 4.7.32.18affected
  • 4.7.33 to < 4.7.33.16affected
  • 4.7.35 to < 4.7.35.15affected
  • 4.7.39 to < 4.7.39.12affected
  • 4.7.51 to < 4.7.51.8affected
  • 4.8.3 to < 4.8.3.10affected
  • 4.8.9 to < 4.8.9.16affected
  • 4.8.12 to < 4.8.12.8affected
  • 4.8.13 to < 4.8.13.9affected
  • 4.8.24 to < 4.8.24.6affected
  • 4.8.32 to < 4.8.32.4affected
  • 4.8.36 to < 4.8.36.2affected
  • 4.8.43 to < 4.8.43.2affected
  • 4.8.43 to < 4.8.43.4affected
  • 4.8.50 to < 4.8.50.1affected
  • 4.8.50 to < 4.8.50.3affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Registry Resources UI

Default version status: unknown

  • 4.7.24 to < 4.7.24.11affected
  • 4.7.32 to < 4.7.32.16affected
  • 4.7.32 to < 4.7.32.18affected
  • 4.7.33 to < 4.7.33.16affected
  • 4.7.35 to < 4.7.35.15affected
  • 4.7.39 to < 4.7.39.12affected
  • 4.7.51 to < 4.7.51.8affected
  • 4.8.3 to < 4.8.3.10affected
  • 4.8.9 to < 4.8.9.16affected
  • 4.8.12 to < 4.8.12.8affected
  • 4.8.13 to < 4.8.13.9affected
  • 4.8.24 to < 4.8.24.6affected
  • 4.8.32 to < 4.8.32.4affected
  • 4.8.36 to < 4.8.36.2affected
  • 4.8.43 to < 4.8.43.2affected
  • 4.8.43 to < 4.8.43.4affected
  • 4.8.50 to < 4.8.50.1affected
  • 4.8.50 to < 4.8.50.3affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Registry Search UI

Default version status: unknown

  • 4.7.24 to < 4.7.24.11affected
  • 4.7.32 to < 4.7.32.16affected
  • 4.7.32 to < 4.7.32.18affected
  • 4.7.33 to < 4.7.33.16affected
  • 4.7.35 to < 4.7.35.15affected
  • 4.7.39 to < 4.7.39.12affected
  • 4.7.51 to < 4.7.51.8affected
  • 4.8.3 to < 4.8.3.10affected
  • 4.8.9 to < 4.8.9.16affected
  • 4.8.12 to < 4.8.12.8affected
  • 4.8.13 to < 4.8.13.9affected
  • 4.8.24 to < 4.8.24.6affected
  • x to ≤ *unaffected

WSO2 WSO2 Stratos User Interface For Tenant CRUD Operations

Default version status: unknown

  • 4.8.1 to < 4.8.1.6affected
  • 4.8.7 to < 4.8.7.3affected
  • 4.9.8 to < 4.9.8.7affected
  • 4.9.10 to < 4.9.10.7affected
  • 4.9.10 to < 4.9.10.8affected
  • 4.9.20 to < 4.9.20.5affected
  • 4.9.27 to < 4.9.27.1affected
  • 4.9.31 to < 4.9.31.1affected
  • 4.9.34 to < 4.9.34.1affected
  • 4.9.42 to < 4.9.42.1affected
  • 4.11.0 to < 4.11.0.7affected
  • 4.11.19 to < 4.11.19.4affected
  • 4.11.34 to < 4.11.34.3affected
  • 4.11.45 to < 4.11.45.1affected
  • x to ≤ *unaffected

WSO2 WSO2 Stratos SSO Redirector UI Component

Default version status: unknown

  • 4.8.1 to < 4.8.1.6affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Email Verification UI

Default version status: unknown

  • 4.7.19 to < 4.7.19.14affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Event Simulator UI

Default version status: unknown

  • 2.2.11 to < 2.2.11.1affected
  • 2.2.14 to < 2.2.14.11affected
  • 2.2.14 to < 2.2.14.12affected
  • 2.2.17 to < 2.2.17.5affected
  • 2.3.1 to < 2.3.1.4affected
  • 2.3.5 to < 2.3.5.6affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Execution Manager UI

Default version status: unknown

  • 5.2.24 to < 5.2.24.10affected
  • 5.2.26 to < 5.2.26.22affected
  • 5.2.34 to < 5.2.34.12affected
  • 5.2.41 to < 5.2.41.7affected
  • 5.2.57 to < 5.2.57.10affected
  • 5.3.5 to < 5.3.5.9affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Governance Custom Lifecycle Checklist UI

Default version status: unknown

  • 4.8.14 to < 4.8.14.4affected
  • 4.8.19 to < 4.8.19.8affected
  • 4.8.21 to < 4.8.21.10affected
  • 4.8.28 to < 4.8.28.4affected
  • 4.8.30 to < 4.8.30.6affected
  • 4.8.32 to < 4.8.32.4affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Governance Generic Artifact User Interface

Default version status: unknown

  • 4.8.14 to < 4.8.14.4affected
  • 4.8.19 to < 4.8.19.8affected
  • 4.8.21 to < 4.8.21.10affected
  • 4.8.28 to < 4.8.28.4affected
  • 4.8.30 to < 4.8.30.6affected
  • 4.8.32 to < 4.8.32.4affected
  • 4.8.33 to < 4.8.33.4affected
  • 4.8.34 to < 4.8.34.5affected
  • 4.8.37 to < 4.8.37.4affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Governance Life Cycles User Interface

Default version status: unknown

  • 4.8.14 to < 4.8.14.4affected
  • 4.8.19 to < 4.8.19.8affected
  • 4.8.21 to < 4.8.21.10affected
  • 4.8.28 to < 4.8.28.4affected
  • 4.8.30 to < 4.8.30.6affected
  • 4.8.32 to < 4.8.32.4affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Governance WSDL Tool UI

Default version status: unknown

  • 4.8.14 to < 4.8.14.4affected
  • 4.8.19 to < 4.8.19.8affected
  • 4.8.21 to < 4.8.21.10affected
  • 4.8.28 to < 4.8.28.4affected
  • 4.8.30 to < 4.8.30.6affected
  • 4.8.32 to < 4.8.32.4affected
  • 4.8.33 to < 4.8.33.4affected
  • 4.8.34 to < 4.8.34.5affected
  • 4.8.37 to < 4.8.37.4affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon New Data Sources UI

Default version status: unknown

  • 4.7.19 to < 4.7.19.13affected
  • 4.7.24 to < 4.7.24.5affected
  • 4.7.32 to < 4.7.32.10affected
  • 4.7.35 to < 4.7.35.13affected
  • 4.7.49 to < 4.7.49.7affected
  • 4.7.52 to < 4.7.52.5affected
  • 4.9.2 to < 4.9.2.8affected
  • 4.9.11 to < 4.9.11.2affected
  • 4.9.18 to < 4.9.18.1affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Registry Info UI2

Default version status: unknown

  • 4.7.32 to < 4.7.32.16affected
  • 4.7.35 to < 4.7.35.15affected
  • 4.7.39 to < 4.7.39.12affected
  • 4.7.51 to < 4.7.51.8affected
  • 4.8.3 to < 4.8.3.10affected
  • 4.8.13 to < 4.8.13.9affected
  • 4.8.32 to < 4.8.32.4affected
  • 4.8.36 to < 4.8.36.2affected
  • 4.8.43 to < 4.8.43.2affected
  • 4.8.50 to < 4.8.50.1affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Registry Relations UI

Default version status: unknown

  • 4.7.24 to < 4.7.24.11affected
  • 4.7.32 to < 4.7.32.16affected
  • 4.7.35 to < 4.7.35.15affected
  • 4.7.39 to < 4.7.39.12affected
  • 4.7.51 to < 4.7.51.8affected
  • 4.8.3 to < 4.8.3.10affected
  • 4.8.13 to < 4.8.13.9affected
  • 4.8.32 to < 4.8.32.4affected
  • 4.8.36 to < 4.8.36.2affected
  • 4.8.43 to < 4.8.43.2affected
  • 4.8.50 to < 4.8.50.1affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Registry Indexing

Default version status: unknown

  • 4.7 to < 4.7.24affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Security UI

Default version status: unknown

  • 5.14 to < 5.14.127affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Component Andes Event UI

Default version status: unknown

  • 3.3.12 to < 3.3.12.3affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Component Andes UI1

Default version status: unknown

  • 3.3.12 to < 3.3.12.3affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon HL7 Business Messaging Store UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Endpoint Editor UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Publish Event Mediator Configuration UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Eventing UI

Default version status: unknown

  • 4.7.19 to < 4.7.19.13affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon HumanTask UI

Default version status: unknown

  • 4.5.27 to < 4.5.27.10affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Logging UI

Default version status: unknown

  • 4.7.19 to < 4.7.19.13affected
  • 4.7.24 to < 4.7.24.5affected
  • 4.7.32 to < 4.7.32.10affected
  • 4.7.52 to < 4.7.52.5affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Template Editor UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Command Mediator UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Rule Mediator UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Throttle Mediator UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Tasks Core

Default version status: unknown

  • 4.7.19 to < 4.7.19.13affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Rest API Admin UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Sequence Editor UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Task UI

Default version status: unknown

  • 4.7.30 to < 4.7.30.53affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Governance

Default version status: unknown

  • 4.8.37 to < 4.8.37.4affected
  • x to ≤ *unaffected

References