Riskcovery

CVE-2025-11093

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)

State
Published
Severity
8.4 High
Published
Nov 5, 2025
Updated
Nov 5, 2025
Reserved
Sep 27, 2025

Read the record on cve.org

Description

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment.

By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.

Scores

CVSSScoreVectorSource
3.18.4 HighCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HWSO2

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
WSO2 Micro IntegratorWSO2
  • before 4.0.0Unknown
  • 4.0.0 to before 4.0.0.145Affected
  • 4.1.0 to before 4.1.0.147Affected
  • 4.2.0 to before 4.2.0.141Affected
  • 4.3.0 to before 4.3.0.42Affected
  • 4.4.0 to before 4.4.0.27Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.345Affected
  • 3.2.0 to before 3.2.0.446Affected
  • 3.2.1 to before 3.2.1.66Affected
  • 4.0.0 to before 4.0.0.366Affected
  • 4.1.0 to before 4.1.0.228Affected
  • 4.2.0 to before 4.2.0.169Affected
  • 4.3.0 to before 4.3.0.81Affected
  • 4.4.0 to before 4.4.0.45Affected
  • 4.5.0 to before 4.5.0.28Affected
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.224Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.27Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.29Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.27Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.414Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.394Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.365Affected
org.apache.synapse:synapse-coreWSO2
  • 2.1.7.wso2v227 to before 2.1.7.wso2v227_99Affected
  • 2.1.7.wso2v271 to before 2.1.7.wso2v271_88Affected
  • 2.1.7.wso2v143 to before 2.1.7.wso2v143_121Affected
  • 2.1.7.wso2v319 to before 2.1.7.wso2v319_13Affected
  • 2.1.7.wso2v183 to before 2.1.7.wso2v183_72Affected
  • 4.0.0.wso2v119 to before 4.0.0.wso2v119_27Affected
  • 4.0.0.wso2v20 to before 4.0.0.wso2v20_93Affected
  • 4.0.0.wso2v215 to before 4.0.0.wso2v215_26Affected
  • 4.0.0.wso2v218 to before 4.0.0.wso2v218_1Affected
  • 4.0.0.wso2v105 to before 4.0.0.wso2v105_13Affected
  • 4.0.0.wso2v131 to before 4.0.0.wso2v131_5Affected
  • 4.0.0-wso2v254 and laterNot affected
org.apache.synapse:synapse-extensionsWSO2
  • 2.1.7.wso2v227 to before 2.1.7.wso2v227_99Affected
  • 2.1.7.wso2v271 to before 2.1.7.wso2v271_88Affected
  • 2.1.7.wso2v143 to before 2.1.7.wso2v143_121Affected
  • 2.1.7.wso2v319 to before 2.1.7.wso2v319_13Affected
  • 2.1.7.wso2v183 to before 2.1.7.wso2v183_72Affected
  • 4.0.0.wso2v119 to before 4.0.0.wso2v119_27Affected
  • 4.0.0.wso2v20 to before 4.0.0.wso2v20_93Affected
  • 4.0.0.wso2v215 to before 4.0.0.wso2v215_26Affected
  • 4.0.0.wso2v218 to before 4.0.0.wso2v218_1Affected
  • 4.0.0.wso2v105 to before 4.0.0.wso2v105_13Affected
  • 4.0.0.wso2v131 to before 4.0.0.wso2v131_5Affected
  • 4.0.0-wso2v254 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.