CVE-2025-5605

MEDIUM

4.3

Description

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.

CVE Details

CVSS v3.1 Score4.3

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack VectorADJACENT_NETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published10/24/2025

Last Modified11/21/2025

Sourcenvd

Honeypot Sightings0

Affected Products

wso2:api_control_planewso2:api_managerwso2:enterprise_integratorwso2:identity_serverwso2:identity_server_as_key_managerwso2:open_banking_amwso2:open_banking_iamwso2:traffic_managerwso2:universal_gateway

Weaknesses (CWE)

CWE-290

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4115/(ed10eef1-636d-4fbe-9993-6890dfa878f8)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.