CVE-2025-6670
BaseFortify
Publication date: 2025-11-18
Last updated on: 2025-12-08
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | api_control_plane | 4.5.0 |
| wso2 | api_control_plane | 4.6.0 |
| wso2 | api_manager | 3.1.0 |
| wso2 | api_manager | 3.2.0 |
| wso2 | api_manager | 3.2.1 |
| wso2 | api_manager | 4.0.0 |
| wso2 | api_manager | 4.1.0 |
| wso2 | api_manager | 4.2.0 |
| wso2 | api_manager | 4.3.0 |
| wso2 | api_manager | 4.4.0 |
| wso2 | api_manager | 4.5.0 |
| wso2 | api_manager | 4.6.0 |
| wso2 | enterprise_integrator | 6.6.0 |
| wso2 | identity_server | 5.10.0 |
| wso2 | identity_server | 5.11.0 |
| wso2 | identity_server | 6.0.0 |
| wso2 | identity_server | 6.1.0 |
| wso2 | identity_server | 7.0.0 |
| wso2 | identity_server | 7.1.0 |
| wso2 | identity_server | 7.2.0 |
| wso2 | identity_server_as_key_manager | 5.10.0 |
| wso2 | open_banking_am | 2.0.0 |
| wso2 | open_banking_iam | 2.0.0 |
| wso2 | traffic_manager | 4.5.0 |
| wso2 | traffic_manager | 4.6.0 |
| wso2 | universal_gateway | 4.5.0 |
| wso2 | universal_gateway | 4.6.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Request Forgery (CSRF) in multiple WSO2 products. It occurs because state-changing operations in admin services use the HTTP GET method, which can be exploited by tricking an authenticated user into visiting a malicious link. This causes the browser to send unintended requests that change data or perform administrative actions without the user's consent. The usual mitigation using the SameSite=Lax cookie attribute is ineffective here because it still allows cookies to be sent with cross-origin GET requests.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to unauthorized operations such as data modification, account changes, or other administrative actions being performed without the user's knowledge or consent. This could compromise the integrity and availability of the affected system and its data.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the Carbon console services by not exposing them to untrusted networks, as recommended by WSO2 Secure Production Guidelines. Additionally, avoid using HTTP GET methods for state-changing operations in admin services to prevent CSRF exploitation.