8.3
HighCVSS 3.1 · from WSO2
CVE-2025-14260
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
WSO2 API Manager · Server-side request forgery · CWE-918AffectedWSO2 API Manager, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM and 4 more
FixUpdate to 3.1.0.354, 3.2.0.458, 3.2.1.99, 4.0.0.379 or newer
PublishedOct 28, 19:21 · WSO2
ScoredOct 28 · 8.3 · WSO2
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
A successful attack can read data and change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
From WSO2
Affected and fixed versions
ProductAffectedFixed inWSO2 API Manager3.1.0 – before 3.1.0.3543.1.0.354WSO2 API Manager3.2.0 – before 3.2.0.4583.2.0.458WSO2 API Manager3.2.1 – before 3.2.1.993.2.1.99WSO2 API Manager4.0.0 – before 4.0.0.3794.0.0.379WSO2 API Manager4.1.0 – before 4.1.0.2654.1.0.265WSO2 API Manager4.2.0 – before 4.2.0.2054.2.0.205WSO2 API Manager4.3.0 – before 4.3.0.1154.3.0.115WSO2 API Manager4.4.0 – before 4.4.0.794.4.0.79WSO2 Identity Server as Key Manager5.10.0 – before 5.10.0.3745.10.0.374WSO2 Open Banking AM2.0.0 – before 2.0.0.4032.0.0.403WSO2 Open Banking IAM2.0.0 – before 2.0.0.4232.0.0.423WSO2 Identity Server5.10.0 – before 5.10.0.3835.10.0.383WSO2 Identity Server5.11.0 – before 5.11.0.4305.11.0.430WSO2 Identity Server6.0.0 – before 6.0.0.2566.0.0.256WSO2 Identity Server6.1.0 – before 6.1.0.2576.1.0.257WSO2 Identity Server7.0.0 – before 7.0.0.1347.0.0.134org.wso2.carbon.identity:org.wso2.carbon.identity.authenticator.saml2.sso.ui5.5.0 – before 5.5.0.25.5.0.2org.wso2.carbon.identity:org.wso2.carbon.identity.authenticator.saml2.sso.ui5.5.2 – before 5.5.2.55.5.2.5org.wso2.carbon.identity:org.wso2.carbon.identity.authenticator.saml2.sso.ui5.5.9 – before 5.5.9.45.5.9.4org.wso2.carbon.identity:org.wso2.carbon.identity.authenticator.saml2.sso.ui5.5.10 – before 5.5.10.15.5.10.1
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known