Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2025-5605

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.361affected
  • 5.11.0 to < 5.11.0.414affected
  • 6.0.0 to < 6.0.0.245affected
  • 6.1.0 to < 6.1.0.244affected
  • 7.0.0 to < 7.0.0.119affected
  • 7.1.0 to < 7.1.0.25affected

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.217affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.10affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.10affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.334affected
  • 3.2.0 to < 3.2.0.430affected
  • 3.2.1 to < 3.2.1.48affected
  • 4.0.0 to < 4.0.0.346affected
  • 4.1.0 to < 4.1.0.210affected
  • 4.2.0 to < 4.2.0.148affected
  • 4.3.0 to < 4.3.0.61affected
  • 4.4.0 to < 4.4.0.24affected
  • 4.5.0 to < 4.5.0.10affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.11affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.354affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.382affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.403affected

WSO2 org.wso2.carbon:org.wso2.carbon.ui

Default version status: unknown

  • 4.5.3 to < 4.5.3.40affected
  • 4.6.0 to < 4.6.0.1224affected
  • 4.6.1 to < 4.6.1.150affected
  • 4.6.2 to < 4.6.2.664affected
  • 4.6.3 to < 4.6.3.32affected
  • 4.6.4 to < 4.6.4.8affected
  • 4.7.1 to < 4.7.1.69affected
  • 4.8.1 to < 4.8.1.33affected
  • 4.9.0 to < 4.9.0.100affected
  • 4.9.26 to < 4.9.26.20affected
  • 4.9.27 to < 4.9.27.4affected
  • 4.9.28 to < 4.9.28.4affected
  • 4.10.9 to < 4.10.9.68affected
  • 4.10.42 to < 4.10.42.10affected
  • 4.9.29 to ≤ 4.9.*unaffected
  • 4.10.90 to ≤ *unaffected

References