جزئیات آسیب‌پذیری
CVE-2025-14260
WSO2 SAML2 SSO Authenticator UI BundleWSO2 API ManagerWSO2 Carbon UIWSO2 Identity ServerWSO2 Identity Server as Key ManagerWSO2 Open Banking AM
Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
CVSS 3.1
8.3بالا
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
Due to the improper implementation of access control rules, malicious actors could perform a Server Side Request Forgery (SSRF) attack on affected WSO2 Products. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem. This could potentially lead to unauthorized access to sensitive data and systems, regardless of whether these resources are located within a private network, as long as they are reachable by the WSO2 product.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.3بالا | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.0 ≤ v < 5.5.0.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.10 ≤ v < 5.5.10.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.2 ≤ v < 5.5.2.5 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.5.9 ≤ v < 5.5.9.4 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.6.4 ≤ v < 5.6.4.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.7.2 ≤ v < 5.7.2.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.8.3 ≤ v < 5.8.3.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.8.7 ≤ v < 5.8.7.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | SAML2 SSO Authenticator UI Bundle | 5.9.4 ≤ v < 5.9.4.2 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | v < 3.1.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.354 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.458 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.99 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.0.0 ≤ v < 4.0.0.379 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.1.0 ≤ v < 4.1.0.265 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.2.0 ≤ v < 4.2.0.205 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.3.0 ≤ v < 4.3.0.115 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 API Manager | 4.4.0 ≤ v < 4.4.0.79 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.10.9 ≤ v < 4.10.9.77 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.0 ≤ v < 4.6.0.2300 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.1 ≤ v < 4.6.1.165 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.3 ≤ v < 4.6.3.46 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.6.4 ≤ v < 4.6.4.28 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.7.1 ≤ v < 4.7.1.79 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.8.1 ≤ v < 4.8.1.50 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.9.0 ≤ v < 4.9.0.107 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.9.26 ≤ v < 4.9.26.37 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Carbon UI | 4.9.27 ≤ v < 4.9.27.24 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.383 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.430 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.256 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.257 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.134 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.374 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.403 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.423 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۰۶
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۲
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- WSO2
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۲۸٪
احتمال بهره‌برداری در ۳۰ روز
۲۰٫۵٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- no
- Exploitation
- none
- Technical Impact
- total
ضعف‌ها (CWE)
- CWE-918Server-Side Request Forgery