Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2025-6670

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this vulnerability by tricking an authenticated user into visiting a crafted link, leading the browser to issue unintended state-changing requests. Successful exploitation could result in unauthorized operations such as data modification, account changes, or other administrative actions. According to WSO2 Secure Production Guidelines, exposure of Carbon console services to untrusted networks is discouraged, which may reduce the impact in properly secured deployments.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.398unaffected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.418unaffected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.34affected
  • 4.6.0 to < 4.6.0.1affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.34affected
  • 4.6.0 to < 4.6.0.1affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.36affected
  • 4.6.0 to < 4.6.0.1affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.349affected
  • 3.2.0 to < 3.2.0.453affected
  • 3.2.1 to < 3.2.1.73affected
  • 4.0.0 to < 4.0.0.373affected
  • 4.1.0 to < 4.1.0.236affected
  • 4.2.0 to < 4.2.0.176affected
  • 4.3.0 to < 4.3.0.88affected
  • 4.4.0 to < 4.4.0.52affected
  • 4.5.0 to < 4.5.0.35affected
  • 4.6.0 to < 4.6.0.1affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.378affected
  • 5.11.0 to < 5.11.0.425affected
  • 6.0.0 to < 6.0.0.252affected
  • 6.1.0 to < 6.1.0.253affected
  • 7.0.0 to < 7.0.0.130affected
  • 7.1.0 to < 7.1.0.38affected
  • 7.2.0 to < 7.2.0.1affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.369affected

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.226affected

WSO2 org.wso2.carbon:org.wso2.carbon.ui

Default version status: unknown

  • 4.5.3 to < 4.5.3.50affected
  • 4.6.0 to < 4.6.0.2253affected
  • 4.6.1 to < 4.6.1.157affected
  • 4.6.2 to < 4.6.2.673affected
  • 4.6.3 to < 4.6.3.41affected
  • 4.6.4 to < 4.6.4.22affected
  • 4.7.1 to < 4.7.1.73affected
  • 4.8.1 to < 4.8.1.43affected
  • 4.9.0 to < 4.9.0.106affected
  • 4.9.26 to < 4.9.26.31affected
  • 4.9.27 to < 4.9.27.16affected
  • 4.9.28 to < 4.9.28.18affected
  • 4.9.33 to < 4.9.33.2affected
  • 4.10.9 to < 4.10.9.75affected
  • 4.10.42 to < 4.10.42.18affected
  • 4.10.101 to < 4.10.101.3affected
  • 4.9.29 to ≤ 4.9.29.*unaffected
  • 4.10.65 to ≤ 4.10.*unaffected

References