جزئیات آسیب‌پذیری
CVE-2025-14260
WSO2 SAML2 SSO Authenticator UI BundleWSO2 API ManagerWSO2 Carbon UIWSO2 Identity ServerWSO2 Identity Server as Key ManagerWSO2 Open Banking AM
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
CVSS 3.1
8.3بالا
شرح رسمی (انگلیسی)
Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.3بالا | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.0 ≤ v < 5.5.0.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.10 ≤ v < 5.5.10.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.2 ≤ v < 5.5.2.5 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.9 ≤ v < 5.5.9.4 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.6.4 ≤ v < 5.6.4.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.7.2 ≤ v < 5.7.2.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.8.3 ≤ v < 5.8.3.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.8.7 ≤ v < 5.8.7.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.9.4 ≤ v < 5.9.4.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | v < 3.1.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.354 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.458 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.99 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.379 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.265 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.205 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.115 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.79 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.10.9 ≤ v < 4.10.9.77 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.0 ≤ v < 4.6.0.2300 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.1 ≤ v < 4.6.1.165 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.3 ≤ v < 4.6.3.46 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.4 ≤ v < 4.6.4.28 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.7.1 ≤ v < 4.7.1.79 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.8.1 ≤ v < 4.8.1.50 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.9.0 ≤ v < 4.9.0.107 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.9.26 ≤ v < 4.9.26.37 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.9.27 ≤ v < 4.9.27.24 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.383 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.430 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.256 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.257 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.134 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.374 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.403 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.423 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۰۶
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۲
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- WSO2
پیش‌بینی بهره‌برداری (EPSS)
۰٫۲۸٪
احتمال بهره‌برداری در ۳۰ روز
۲۰٫۵٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-918Server-Side Request Forgery