Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2025-5350

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context. By tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk. Furthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.359affected
  • 5.11.0 to < 5.11.0.415affected
  • 6.0.0 to < 6.0.0.246affected
  • 6.1.0 to < 6.1.0.245affected
  • 7.0.0 to < 7.0.0.120affected
  • 7.1.0 to < 7.1.0.27affected

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.218affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.332affected
  • 3.2.0 to < 3.2.0.428affected
  • 3.2.1 to < 3.2.1.47affected
  • 4.0.0 to < 4.0.0.369affected
  • 4.1.0 to < 4.1.0.209affected
  • 4.2.0 to < 4.2.0.147affected
  • 4.3.0 to < 4.3.0.60affected
  • 4.4.0 to < 4.4.0.23affected
  • 4.5.0 to < 4.5.0.7affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.7affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.7affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.7affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.380affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.401affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.352affected

WSO2 org.wso2.carbon:org.wso2.carbon.ui

Default version status: unknown

  • 4.5.3 to < 4.5.3.41affected
  • 4.6.0 to < 4.6.0.1087affected
  • 4.6.1 to < 4.6.1.151affected
  • 4.6.2 to < 4.6.2.672affected
  • 4.6.3 to < 4.6.3.30affected
  • 4.6.4 to < 4.6.4.7affected
  • 4.7.1 to < 4.7.1.70affected
  • 4.8.1 to < 4.8.1.32affected
  • 4.9.0 to < 4.9.0.101affected
  • 4.9.26 to < 4.9.26.19affected
  • 4.9.27 to < 4.9.27.3affected
  • 4.9.28 to < 4.9.28.1affected
  • 4.10.9 to < 4.10.9.69affected
  • 4.10.42 to < 4.10.42.11affected
  • 4.9.29 to ≤ 4.9.*unaffected
  • 4.10.93 to ≤ *unaffected

References