CVE-2025-6670

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-12-08

Assigner: WSO2 LLC

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this vulnerability by tricking an authenticated user into visiting a crafted link, leading the browser to issue unintended state-changing requests. Successful exploitation could result in unauthorized operations such as data modification, account changes, or other administrative actions. According to WSO2 Secure Production Guidelines, exposure of Carbon console services to untrusted networks is discouraged, which may reduce the impact in properly secured deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-12-08

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-6670

EUVD

EUVD-2025-197976

Affected Vendors & Products

Vendor	Product	Version / Range
wso2	api_control_plane	4.5.0
wso2	api_control_plane	4.6.0
wso2	api_manager	3.1.0
wso2	api_manager	3.2.0
wso2	api_manager	3.2.1
wso2	api_manager	4.0.0
wso2	api_manager	4.1.0
wso2	api_manager	4.2.0
wso2	api_manager	4.3.0
wso2	api_manager	4.4.0
wso2	api_manager	4.5.0
wso2	api_manager	4.6.0
wso2	enterprise_integrator	6.6.0
wso2	identity_server	5.10.0
wso2	identity_server	5.11.0
wso2	identity_server	6.0.0
wso2	identity_server	6.1.0
wso2	identity_server	7.0.0
wso2	identity_server	7.1.0
wso2	identity_server	7.2.0
wso2	identity_server_as_key_manager	5.10.0
wso2	open_banking_am	2.0.0
wso2	open_banking_iam	2.0.0
wso2	traffic_manager	4.5.0
wso2	traffic_manager	4.6.0
wso2	universal_gateway	4.5.0
wso2	universal_gateway	4.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) in multiple WSO2 products. It occurs because state-changing operations in admin services use the HTTP GET method, which can be exploited by tricking an authenticated user into visiting a malicious link. This causes the browser to send unintended requests that change data or perform administrative actions without the user's consent. The usual mitigation using the SameSite=Lax cookie attribute is ineffective here because it still allows cookies to be sent with cross-origin GET requests.

Impact Analysis

If exploited, this vulnerability can lead to unauthorized operations such as data modification, account changes, or other administrative actions being performed without the user's knowledge or consent. This could compromise the integrity and availability of the affected system and its data.

Mitigation Strategies

Immediate mitigation steps include restricting access to the Carbon console services by not exposing them to untrusted networks, as recommended by WSO2 Secure Production Guidelines. Additionally, avoid using HTTP GET methods for state-changing operations in admin services to prevent CSRF exploitation.

Hi! I’m here to help you understand CVE-2025-6670. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70