جزئیات آسیبپذیری
CVE-2025-11093
WSO2 API Control PlaneWSO2 API ManagerWSO2 Enterprise IntegratorWSO2 Identity Server as Key ManagerWSO2 Micro IntegratorWSO2 Open Banking AM
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
CVSS 3.1
8.4بالا
شرح رسمی (انگلیسی)
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.4بالا | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| WSO2 | WSO2 API Control Plane | 4.5.0 ≤ v < 4.5.0.29 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | v < 3.1.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.345 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.446 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.66 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.366 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.228 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.169 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.81 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.45 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.5.0 ≤ v < 4.5.0.28 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Enterprise Integrator | v < 6.6.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Enterprise Integrator | 6.6.0 ≤ v < 6.6.0.224 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.365 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | v < 4.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.0.0 ≤ v < 4.0.0.145 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.1.0 ≤ v < 4.1.0.147 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.2.0 ≤ v < 4.2.0.141 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.3.0 ≤ v < 4.3.0.42 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Micro Integrator | 4.4.0 ≤ v < 4.4.0.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.394 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.414 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Traffic Manager | 4.5.0 ≤ v < 4.5.0.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Universal Gateway | 4.5.0 ≤ v < 4.5.0.27 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 2.1.7.wso2v143 ≤ v < 2.1.7.wso2v143_121 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 2.1.7.wso2v183 ≤ v < 2.1.7.wso2v183_72 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 2.1.7.wso2v227 ≤ v < 2.1.7.wso2v227_99 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 2.1.7.wso2v271 ≤ v < 2.1.7.wso2v271_88 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 2.1.7.wso2v319 ≤ v < 2.1.7.wso2v319_13 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 4.0.0.wso2v105 ≤ v < 4.0.0.wso2v105_13 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 4.0.0.wso2v119 ≤ v < 4.0.0.wso2v119_27 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 4.0.0.wso2v131 ≤ v < 4.0.0.wso2v131_5 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 4.0.0.wso2v20 ≤ v < 4.0.0.wso2v20_93 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 4.0.0.wso2v215 ≤ v < 4.0.0.wso2v215_26 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-core | 4.0.0.wso2v218 ≤ v < 4.0.0.wso2v218_1 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 2.1.7.wso2v143 ≤ v < 2.1.7.wso2v143_121 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 2.1.7.wso2v183 ≤ v < 2.1.7.wso2v183_72 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 2.1.7.wso2v227 ≤ v < 2.1.7.wso2v227_99 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 2.1.7.wso2v271 ≤ v < 2.1.7.wso2v271_88 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 2.1.7.wso2v319 ≤ v < 2.1.7.wso2v319_13 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 4.0.0.wso2v105 ≤ v < 4.0.0.wso2v105_13 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 4.0.0.wso2v119 ≤ v < 4.0.0.wso2v119_27 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 4.0.0.wso2v131 ≤ v < 4.0.0.wso2v131_5 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 4.0.0.wso2v20 ≤ v < 4.0.0.wso2v20_93 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 4.0.0.wso2v215 ≤ v < 4.0.0.wso2v215_26 | CVEProject cvelistV5 (CNA) |
| WSO2 | org.apache.synapse:synapse-extensions | 4.0.0.wso2v218 ≤ v < 4.0.0.wso2v218_1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۴/۰۸/۱۴
- آخرین بهروزرسانی
- ۱۴۰۴/۰۸/۱۴
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- WSO2
پیشبینی بهرهبرداری (EPSS)
۰٫۴۷٪
احتمال بهرهبرداری در ۳۰ روز
۴۰٫۹٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهرهبرداری
- ندارد
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')