Riskcovery

CVE-2025-5605

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure

State
Published
Severity
4.3 Medium
Published
Oct 24, 2025
Updated
Oct 24, 2025
Reserved
Jun 4, 2025

Read the record on cve.org

Description

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.

The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.

Scores

CVSSScoreVectorSource
3.14.3 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWSO2

Weaknesses

  • CWE-290 Authentication Bypass by Spoofing

Affected Products

ProductVersions
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.361Affected
  • 5.11.0 to before 5.11.0.414Affected
  • 6.0.0 to before 6.0.0.245Affected
  • 6.1.0 to before 6.1.0.244Affected
  • 7.0.0 to before 7.0.0.119Affected
  • 7.1.0 to before 7.1.0.25Affected
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.217Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.10Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.10Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.334Affected
  • 3.2.0 to before 3.2.0.430Affected
  • 3.2.1 to before 3.2.1.48Affected
  • 4.0.0 to before 4.0.0.346Affected
  • 4.1.0 to before 4.1.0.210Affected
  • 4.2.0 to before 4.2.0.148Affected
  • 4.3.0 to before 4.3.0.61Affected
  • 4.4.0 to before 4.4.0.24Affected
  • 4.5.0 to before 4.5.0.10Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.11Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.354Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.382Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.403Affected
org.wso2.carbon:org.wso2.carbon.uiWSO2
  • 4.5.3 to before 4.5.3.40Affected
  • 4.6.0 to before 4.6.0.1224Affected
  • 4.6.1 to before 4.6.1.150Affected
  • 4.6.2 to before 4.6.2.664Affected
  • 4.6.3 to before 4.6.3.32Affected
  • 4.6.4 to before 4.6.4.8Affected
  • 4.7.1 to before 4.7.1.69Affected
  • 4.8.1 to before 4.8.1.33Affected
  • 4.9.0 to before 4.9.0.100Affected
  • 4.9.26 to before 4.9.26.20Affected
  • 4.9.27 to before 4.9.27.4Affected
  • 4.9.28 to before 4.9.28.4Affected
  • 4.10.9 to before 4.10.9.68Affected
  • 4.10.42 to before 4.10.42.10Affected
  • 4.9.29 through 4.9.*Not affected
  • 4.10.90 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.