{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-10907","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","state":"PUBLISHED","assignerShortName":"WSO2","dateReserved":"2025-09-24T09:25:09.461Z","datePublished":"2025-11-05T18:03:49.831Z","dateUpdated":"2025-11-05T18:49:44.604Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.345","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.448","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.66","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.367","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.230","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.169","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.81","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.45","status":"affected","version":"4.4.0","versionType":"custom"},{"lessThan":"4.5.0.28","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.414","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.394","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"lessThan":"4.5.0.29","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"lessThan":"4.5.0.27","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"lessThan":"4.5.0.27","status":"affected","version":"4.5.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Micro Integrator","vendor":"WSO2","versions":[{"lessThan":"4.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"4.0.0.145","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.147","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.141","status":"affected","version":"4.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.375","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.419","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.248","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.248","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.124","status":"affected","version":"7.0.0","versionType":"custom"},{"lessThan":"7.1.0.31","status":"affected","version":"7.1.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.365","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.6.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.6.0.224","status":"affected","version":"6.6.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt","product":"org.jaggeryjs:org.jaggeryjs.jaggery.app.mgt","vendor":"WSO2","versions":[{"lessThan":"0.14.13.8","status":"affected","version":"0.14.13","versionType":"custom"},{"lessThan":"0.14.16.1","status":"affected","version":"0.14.16","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core","product":"org.wso2.carbon.event-processing:org.wso2.carbon.event.simulator.core","vendor":"WSO2","versions":[{"lessThan":"2.2.14.7","status":"affected","version":"2.2.14","versionType":"custom"},{"lessThan":"2.2.17.2","status":"affected","version":"2.2.17","versionType":"custom"},{"lessThan":"2.3.1.3","status":"affected","version":"2.3.1","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"2.3.19","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.mediation:org.wso2.carbon.mediation.library","product":"org.wso2.carbon.mediation:org.wso2.carbon.mediation.library","vendor":"WSO2","versions":[{"lessThan":"4.7.30.47","status":"affected","version":"4.7.30","versionType":"custom"},{"lessThan":"4.7.61.62","status":"affected","version":"4.7.61","versionType":"custom"},{"lessThan":"4.7.99.304","status":"affected","version":"4.7.99","versionType":"custom"},{"lessThan":"4.7.131.22","status":"affected","version":"4.7.131","versionType":"custom"},{"lessThan":"4.7.175.30","status":"affected","version":"4.7.175","versionType":"custom"},{"lessThan":"4.7.188.12","status":"affected","version":"4.7.188","versionType":"custom"},{"lessThan":"4.7.204.13","status":"affected","version":"4.7.204","versionType":"custom"},{"lessThan":"4.7.221.7","status":"affected","version":"4.7.221","versionType":"custom"},{"lessThan":"4.7.245.7","status":"affected","version":"4.7.245","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"4.7.262","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.deployment:org.wso2.carbon.module.mgt","product":"org.wso2.carbon.deployment:org.wso2.carbon.module.mgt","vendor":"WSO2","versions":[{"lessThan":"4.9.15.2","status":"affected","version":"4.9.15","versionType":"custom"},{"lessThan":"4.10.1.1","status":"affected","version":"4.10.1","versionType":"custom"},{"lessThan":"4.10.9.2","status":"affected","version":"4.10.9","versionType":"custom"},{"lessThan":"4.11.1.3","status":"affected","version":"4.11.1","versionType":"custom"},{"lessThan":"4.11.3.3","status":"affected","version":"4.11.3","versionType":"custom"},{"lessThan":"4.11.7.5","status":"affected","version":"4.11.7","versionType":"custom"},{"lessThan":"4.11.14.2","status":"affected","version":"4.11.14","versionType":"custom"},{"lessThan":"4.11.17.3","status":"affected","version":"4.11.17","versionType":"custom"},{"lessThan":"4.11.18.1","status":"affected","version":"4.11.18","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"4.11.24","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt","product":"org.wso2.carbon.deployment:org.wso2.carbon.webapp.mgt","vendor":"WSO2","versions":[{"lessThan":"4.10.1.1","status":"affected","version":"4.10.1","versionType":"custom"},{"lessThan":"4.10.9.2","status":"affected","version":"4.10.9","versionType":"custom"},{"lessThan":"4.11.1.3","status":"affected","version":"4.11.1","versionType":"custom"},{"lessThan":"4.11.3.3","status":"affected","version":"4.11.3","versionType":"custom"},{"lessThan":"4.11.7.5","status":"affected","version":"4.11.7","versionType":"custom"},{"lessThan":"4.11.14.2","status":"affected","version":"4.11.14","versionType":"custom"},{"lessThan":"4.11.17.3","status":"affected","version":"4.11.17","versionType":"custom"},{"lessThan":"4.11.18.1","status":"affected","version":"4.11.18","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"4.11.24","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.apache.ws.commons.axiom.wso2:axiom","product":"org.apache.ws.commons.axiom.wso2:axiom","vendor":"WSO2","versions":[{"lessThan":"1.2.11.wso2v17_5","status":"affected","version":"1.2.11","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"1.2.11-wso2v21","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.base","product":"org.wso2.carbon:org.wso2.carbon.base","vendor":"WSO2","versions":[{"lessThan":"4.5.3.46","status":"affected","version":"4.5.3","versionType":"custom"},{"lessThan":"4.6.0.2005","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.1.153","status":"affected","version":"4.6.1","versionType":"custom"},{"lessThan":"4.6.2.668","status":"affected","version":"4.6.2","versionType":"custom"},{"lessThan":"4.6.3.37","status":"affected","version":"4.6.3","versionType":"custom"},{"lessThan":"4.6.4.15","status":"affected","version":"4.6.4","versionType":"custom"},{"lessThan":"4.7.1.72","status":"affected","version":"4.7.1","versionType":"custom"},{"lessThan":"4.8.1.40","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.9.0.103","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"4.9.26.26","status":"affected","version":"4.9.26","versionType":"custom"},{"lessThan":"4.9.27.11","status":"affected","version":"4.9.27","versionType":"custom"},{"lessThan":"4.9.28.12","status":"affected","version":"4.9.28","versionType":"custom"},{"lessThan":"4.10.9.71","status":"affected","version":"4.10.9","versionType":"custom"},{"lessThan":"4.10.42.14","status":"affected","version":"4.10.42","versionType":"custom"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.30","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"4.10.95","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.utils","product":"org.wso2.carbon:org.wso2.carbon.utils","vendor":"WSO2","versions":[{"lessThan":"4.5.3.46","status":"affected","version":"4.5.3","versionType":"custom"},{"lessThan":"4.6.0.2005","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.1.153","status":"affected","version":"4.6.1","versionType":"custom"},{"lessThan":"4.6.2.668","status":"affected","version":"4.6.2","versionType":"custom"},{"lessThan":"4.6.3.37","status":"affected","version":"4.6.3","versionType":"custom"},{"lessThan":"4.6.4.15","status":"affected","version":"4.6.4","versionType":"custom"},{"lessThan":"4.7.1.72","status":"affected","version":"4.7.1","versionType":"custom"},{"lessThan":"4.8.1.40","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.9.0.103","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"4.9.26.26","status":"affected","version":"4.9.26","versionType":"custom"},{"lessThan":"4.9.27.11","status":"affected","version":"4.9.27","versionType":"custom"},{"lessThan":"4.9.28.12","status":"affected","version":"4.9.28","versionType":"custom"},{"lessThan":"4.10.9.71","status":"affected","version":"4.10.9","versionType":"custom"},{"lessThan":"4.10.42.14","status":"affected","version":"4.10.42","versionType":"custom"},{"lessThanOrEqual":"4.9.*","status":"unaffected","version":"4.9.30","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"4.10.95","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.1.0.345","versionStartIncluding":"3.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0.448","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.1.66","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.367","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.230","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.169","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.81","versionStartIncluding":"4.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.4.0.45","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.28","versionStartIncluding":"4.5.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.414","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.394","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.29","versionStartIncluding":"4.5.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.27","versionStartIncluding":"4.5.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.0.27","versionStartIncluding":"4.5.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.145","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.147","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.141","versionStartIncluding":"4.2.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.375","versionStartIncluding":"5.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.0.419","versionStartIncluding":"5.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0.248","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.0.248","versionStartIncluding":"6.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.0.124","versionStartIncluding":"7.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.0.31","versionStartIncluding":"7.1.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.365","versionStartIncluding":"5.10.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.0.224","versionStartIncluding":"6.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"0.14.13.8","versionStartIncluding":"0.14.13","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.jaggeryjs_org.jaggeryjs.jaggery.app.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"0.14.16.1","versionStartIncluding":"0.14.16","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*","versionEndExcluding":"2.2.14.7","versionStartIncluding":"2.2.14","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*","versionEndExcluding":"2.2.17.2","versionStartIncluding":"2.2.17","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*","versionEndExcluding":"2.3.1.3","versionStartIncluding":"2.3.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.event-processing_org.wso2.carbon.event.simulator.core:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"2.3.19","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.30.47","versionStartIncluding":"4.7.30","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.61.62","versionStartIncluding":"4.7.61","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.99.304","versionStartIncluding":"4.7.99","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.131.22","versionStartIncluding":"4.7.131","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.175.30","versionStartIncluding":"4.7.175","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.188.12","versionStartIncluding":"4.7.188","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.204.13","versionStartIncluding":"4.7.204","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.221.7","versionStartIncluding":"4.7.221","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.245.7","versionStartIncluding":"4.7.245","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.mediation_org.wso2.carbon.mediation.library:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"4.7.262","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.15.2","versionStartIncluding":"4.9.15","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.1.1","versionStartIncluding":"4.10.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.9.2","versionStartIncluding":"4.10.9","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.1.3","versionStartIncluding":"4.11.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.3.3","versionStartIncluding":"4.11.3","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.7.5","versionStartIncluding":"4.11.7","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.14.2","versionStartIncluding":"4.11.14","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.17.3","versionStartIncluding":"4.11.17","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.18.1","versionStartIncluding":"4.11.18","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.module.mgt:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"4.11.24","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.1.1","versionStartIncluding":"4.10.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.9.2","versionStartIncluding":"4.10.9","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.1.3","versionStartIncluding":"4.11.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.3.3","versionStartIncluding":"4.11.3","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.7.5","versionStartIncluding":"4.11.7","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.14.2","versionStartIncluding":"4.11.14","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.17.3","versionStartIncluding":"4.11.17","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndExcluding":"4.11.18.1","versionStartIncluding":"4.11.18","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon.deployment_org.wso2.carbon.webapp.mgt:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"4.11.24","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.apache.ws.commons.axiom.wso2_axiom:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.11.wso2v17_5","versionStartIncluding":"1.2.11","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.apache.ws.commons.axiom.wso2_axiom:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"1.2.11-wso2v21","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.3.46","versionStartIncluding":"4.5.3","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.0.2005","versionStartIncluding":"4.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.1.153","versionStartIncluding":"4.6.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.2.668","versionStartIncluding":"4.6.2","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.3.37","versionStartIncluding":"4.6.3","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.4.15","versionStartIncluding":"4.6.4","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.1.72","versionStartIncluding":"4.7.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.8.1.40","versionStartIncluding":"4.8.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.0.103","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.26.26","versionStartIncluding":"4.9.26","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.27.11","versionStartIncluding":"4.9.27","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.28.12","versionStartIncluding":"4.9.28","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.9.71","versionStartIncluding":"4.10.9","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.42.14","versionStartIncluding":"4.10.42","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndIncluding":"4.9.*","versionStartIncluding":"4.9.30","vulnerable":false},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.base:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"4.10.95","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.5.3.46","versionStartIncluding":"4.5.3","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.0.2005","versionStartIncluding":"4.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.1.153","versionStartIncluding":"4.6.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.2.668","versionStartIncluding":"4.6.2","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.3.37","versionStartIncluding":"4.6.3","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.6.4.15","versionStartIncluding":"4.6.4","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.7.1.72","versionStartIncluding":"4.7.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.8.1.40","versionStartIncluding":"4.8.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.0.103","versionStartIncluding":"4.9.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.26.26","versionStartIncluding":"4.9.26","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.27.11","versionStartIncluding":"4.9.27","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.9.28.12","versionStartIncluding":"4.9.28","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.9.71","versionStartIncluding":"4.10.9","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndExcluding":"4.10.42.14","versionStartIncluding":"4.10.42","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndIncluding":"4.9.*","versionStartIncluding":"4.9.30","vulnerable":false},{"criteria":"cpe:2.3:a:wso2:org.wso2.carbon_org.wso2.carbon.utils:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"4.10.95","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"reporter","value":"crnković"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.<br><br>Successful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services.<br>"}],"value":"An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. A malicious actor with administrative privileges can upload a specially crafted file to a user-controlled location within the deployment.\n\nSuccessful exploitation may lead to remote code execution (RCE) on the server, depending on how the uploaded file is processed. By default, this vulnerability is only exploitable by users with administrative access to the affected SOAP services."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","description":"CWE-434 Unrestricted Upload of File with Dangerous Type","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2","dateUpdated":"2025-11-05T18:03:49.831Z"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution</span></a> <br>"}],"value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4603/#solution"}],"source":{"advisory":"WSO2-2025-4603","discovery":"EXTERNAL"},"title":"Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution","x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-11-05T18:49:26.232581Z","id":"CVE-2025-10907","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-11-05T18:49:44.604Z"}}]}}