CVE-2025-13394
Received Received - Intake

CSRF in WSO2 Carbon Console via Ajax Processor

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: WSO2 LLC

Description
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2025-13394
EUVD
EUVD-2025-210631

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
wso2 api_control_plane *
wso2 api_manager *
wso2 enterprise_integrator *
wso2 identity_server *
wso2 open_banking_am_iam *
wso2 traffic_manager *
wso2 universal_gateway *
wso2 carbon_console *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Carbon console's Ajax processor. It occurs because state-changing operations use HTTP GET requests, which are vulnerable to CSRF attacks. The SameSite=Lax cookie attribute is used as a mitigation but fails because it allows cookies to be sent with cross-origin GET requests, enabling attackers to trick authenticated users into executing unintended actions.

Detection Guidance

Detecting this CSRF vulnerability requires checking if the Carbon console uses HTTP GET for state-changing operations and if SameSite=Lax cookies are insufficient. Inspect network traffic for GET requests performing actions like POST/PUT/DELETE operations. Use browser developer tools to examine cookie attributes and request methods.

Impact Analysis

An attacker could exploit this to perform unauthorized actions on your behalf, such as modifying data, changing account settings, or other state-altering requests. This could lead to data compromise or loss of control over your account. The attack is only possible if the Carbon console is exposed to the public internet.

Mitigation Strategies

Immediately disable HTTP GET for state-changing operations in the Carbon console. Replace with POST/PUT/DELETE methods and ensure proper CSRF tokens are used. Restrict public internet exposure of the Carbon console as per WSO2 guidelines. Update to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart