جزئیات آسیبپذیری
CVE-2025-10907
WSO2 API Control PlaneWSO2 API ManagerWSO2 Enterprise IntegratorWSO2 Identity ServerWSO2 Identity Server as Key ManagerWSO2 Micro Integrator
Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
CVSS 3.1
8.4بالا
شرح رسمی (انگلیسی)
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment. Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.4بالا | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0 ≤ v < 4.5.0.29 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | v < 3.1.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.345 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.448 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.66 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.367 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.230 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.169 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.81 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.45 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.5.0 ≤ v < 4.5.0.28 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Enterprise Integrator | v < 6.6.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Enterprise Integrator | 6.6.0 ≤ v < 6.6.0.224 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.375 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.419 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.248 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.248 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.124 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.1.0 ≤ v < 7.1.0.31 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.365 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | v < 4.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.0.0 ≤ v < 4.0.0.145 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.1.0 ≤ v < 4.1.0.147 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.2.0 ≤ v < 4.2.0.141 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.394 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.414 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | 4.5.0 ≤ v < 4.5.0.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | 4.5.0 ≤ v < 4.5.0.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.ws.commons.axiom.wso2:axiom | 1.2.11 ≤ v < 1.2.11.wso2v17_5 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt | 0.14.13 ≤ v < 0.14.13.8 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt | 0.14.16 ≤ v < 0.14.16.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.10.1 ≤ v < 4.10.1.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.10.9 ≤ v < 4.10.9.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.11.1 ≤ v < 4.11.1.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.11.14 ≤ v < 4.11.14.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.11.17 ≤ v < 4.11.17.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.11.18 ≤ v < 4.11.18.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.11.3 ≤ v < 4.11.3.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.11.7 ≤ v < 4.11.7.5 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.module.mgt | 4.9.15 ≤ v < 4.9.15.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.10.1 ≤ v < 4.10.1.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.10.9 ≤ v < 4.10.9.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.11.1 ≤ v < 4.11.1.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.11.14 ≤ v < 4.11.14.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.11.17 ≤ v < 4.11.17.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.11.18 ≤ v < 4.11.18.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.11.3 ≤ v < 4.11.3.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt | 4.11.7 ≤ v < 4.11.7.5 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core | 2.2.14 ≤ v < 2.2.14.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core | 2.2.17 ≤ v < 2.2.17.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core | 2.3.1 ≤ v < 2.3.1.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.131 ≤ v < 4.7.131.22 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.175 ≤ v < 4.7.175.30 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.188 ≤ v < 4.7.188.12 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.204 ≤ v < 4.7.204.13 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.221 ≤ v < 4.7.221.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.245 ≤ v < 4.7.245.7 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.30 ≤ v < 4.7.30.47 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.61 ≤ v < 4.7.61.62 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.mediation.library | 4.7.99 ≤ v < 4.7.99.304 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.10.42 ≤ v < 4.10.42.14 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.10.9 ≤ v < 4.10.9.71 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.5.3 ≤ v < 4.5.3.46 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.6.0 ≤ v < 4.6.0.2005 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.6.1 ≤ v < 4.6.1.153 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.6.2 ≤ v < 4.6.2.668 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.6.3 ≤ v < 4.6.3.37 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.6.4 ≤ v < 4.6.4.15 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.7.1 ≤ v < 4.7.1.72 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.8.1 ≤ v < 4.8.1.40 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.9.0 ≤ v < 4.9.0.103 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.9.26 ≤ v < 4.9.26.26 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.9.27 ≤ v < 4.9.27.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.base | 4.9.28 ≤ v < 4.9.28.12 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.10.42 ≤ v < 4.10.42.14 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.10.9 ≤ v < 4.10.9.71 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.5.3 ≤ v < 4.5.3.46 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.6.0 ≤ v < 4.6.0.2005 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.6.1 ≤ v < 4.6.1.153 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.6.2 ≤ v < 4.6.2.668 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.6.3 ≤ v < 4.6.3.37 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.6.4 ≤ v < 4.6.4.15 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.7.1 ≤ v < 4.7.1.72 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.8.1 ≤ v < 4.8.1.40 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.9.0 ≤ v < 4.9.0.103 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.9.26 ≤ v < 4.9.26.26 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.9.27 ≤ v < 4.9.27.11 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.wso2.carbon:org.wso2.carbon.utils | 4.9.28 ≤ v < 4.9.28.12 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۰۸/۱۴
- آخرین بهروزرسانی
- ۱۴۰۴/۰۸/۱۴
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- WSO2
پیشبینی بهرهبرداری (EPSS)
۰٫۵۹٪
احتمال بهرهبرداری در ۳۰ روز
۴۸٫۶٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهرهبرداری
- ندارد
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type