CVE-2025-6670
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-12-08

Assigner: WSO2 LLC

Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests. A malicious actor can exploit this vulnerability by tricking an authenticated user into visiting a crafted link, leading the browser to issue unintended state-changing requests. Successful exploitation could result in unauthorized operations such as data modification, account changes, or other administrative actions. According to WSO2 Secure Production Guidelines, exposure of Carbon console services to untrusted networks is discouraged, which may reduce the impact in properly secured deployments.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-18
Last Modified
2025-12-08
Generated
2026-06-16
AI Q&A
2025-11-18
EPSS Evaluated
2026-06-15
NVD
CVE-2025-6670
EUVD
EUVD-2025-197976
Affected Vendors & Products
Showing 27 associated CPEs
Vendor Product Version / Range
wso2 api_control_plane 4.5.0
wso2 api_control_plane 4.6.0
wso2 api_manager 3.1.0
wso2 api_manager 3.2.0
wso2 api_manager 3.2.1
wso2 api_manager 4.0.0
wso2 api_manager 4.1.0
wso2 api_manager 4.2.0
wso2 api_manager 4.3.0
wso2 api_manager 4.4.0
wso2 api_manager 4.5.0
wso2 api_manager 4.6.0
wso2 enterprise_integrator 6.6.0
wso2 identity_server 5.10.0
wso2 identity_server 5.11.0
wso2 identity_server 6.0.0
wso2 identity_server 6.1.0
wso2 identity_server 7.0.0
wso2 identity_server 7.1.0
wso2 identity_server 7.2.0
wso2 identity_server_as_key_manager 5.10.0
wso2 open_banking_am 2.0.0
wso2 open_banking_iam 2.0.0
wso2 traffic_manager 4.5.0
wso2 traffic_manager 4.6.0
wso2 universal_gateway 4.5.0
wso2 universal_gateway 4.6.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) in multiple WSO2 products. It occurs because state-changing operations in admin services use the HTTP GET method, which can be exploited by tricking an authenticated user into visiting a malicious link. This causes the browser to send unintended requests that change data or perform administrative actions without the user's consent. The usual mitigation using the SameSite=Lax cookie attribute is ineffective here because it still allows cookies to be sent with cross-origin GET requests.

Impact Analysis

If exploited, this vulnerability can lead to unauthorized operations such as data modification, account changes, or other administrative actions being performed without the user's knowledge or consent. This could compromise the integrity and availability of the affected system and its data.

Mitigation Strategies

Immediate mitigation steps include restricting access to the Carbon console services by not exposing them to untrusted networks, as recommended by WSO2 Secure Production Guidelines. Additionally, avoid using HTTP GET methods for state-changing operations in admin services to prevent CSRF exploitation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-6670. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart