Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2025-13394

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

CVSS 5.4 MediumEPSS 0.0014 · 3rd percentile

Published by the CVE Program (CNA: WSO2) at 6 Aug 2026, 07:33 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
WSO2 WSO2 Identity Server
  • unknown before 5.10.0 custom
  • affected 5.10.0 to before 5.10.0.381 custom
  • affected 5.11.0 to before 5.11.0.428 custom
  • affected 6.0.0 to before 6.0.0.255 custom
  • affected 6.1.0 to before 6.1.0.256 custom
  • affected 7.0.0 to before 7.0.0.133 custom
  • affected 7.1.0 to before 7.1.0.41 custom
  • affected 7.2.0 to before 7.2.0.3 custom
Other versions: unaffected
WSO2 WSO2 API Manager
  • unknown before 3.1.0 custom
  • affected 3.1.0 to before 3.1.0.352 custom
  • affected 3.2.0 to before 3.2.0.456 custom
  • affected 3.2.1 to before 3.2.1.75 custom
  • affected 4.0.0 to before 4.0.0.376 custom
  • affected 4.1.0 to before 4.1.0.239 custom
  • affected 4.2.0 to before 4.2.0.179 custom
  • affected 4.3.0 to before 4.3.0.91 custom
  • affected 4.4.0 to before 4.4.0.55 custom
  • affected 4.5.0 to before 4.5.0.38 custom
  • affected 4.6.0 to before 4.6.0.3 custom
Other versions: unaffected
WSO2 WSO2 Open Banking IAM
  • unknown before 2.0.0 custom
  • affected 2.0.0 to before 2.0.0.421 custom
Other versions: unaffected
WSO2 WSO2 Open Banking AM
  • unknown before 2.0.0 custom
  • affected 2.0.0 to before 2.0.0.401 custom
Other versions: unaffected
WSO2 WSO2 Identity Server as Key Manager
  • unknown before 5.10.0 custom
  • affected 5.10.0 to before 5.10.0.372 custom
Other versions: unaffected
WSO2 WSO2 API Control Plane
  • unknown before 4.5.0 custom
  • affected 4.5.0 to before 4.5.0.39 custom
  • affected 4.6.0 to before 4.6.0.3 custom
Other versions: unaffected
WSO2 WSO2 Universal Gateway
  • unknown before 4.5.0 custom
  • affected 4.5.0 to before 4.5.0.37 custom
  • affected 4.6.0 to before 4.6.0.3 custom
Other versions: unaffected
WSO2 WSO2 Traffic Manager
  • unknown before 4.5.0 custom
  • affected 4.5.0 to before 4.5.0.37 custom
  • affected 4.6.0 to before 4.6.0.3 custom
Other versions: unaffected
WSO2 WSO2 Enterprise Integrator
  • unknown before 6.6.0 custom
  • affected 6.6.0 to before 6.6.0.227 custom
Other versions: unaffected
WSO2 WSO2 Carbon Identity Entitlement UI Package name: org.wso2.carbon.identity.framework:org.wso2.carbon.identity.entitlement.ui
  • affected 5.17.5 to before 5.17.5.331 custom
  • affected 5.18.187 to before 5.18.187.329 custom
  • affected 5.23.8 to before 5.23.8.210 custom
  • affected 5.25.92 to before 5.25.92.166 custom
  • affected 7.0.78 to before 7.0.78.157 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Identity Management UI1 Package name: org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui
  • affected 5.17.5 to before 5.17.5.330 custom
  • affected 5.17.5 to before 5.17.5.331 custom
  • affected 5.17.118 to before 5.17.118.22 custom
  • affected 5.18.187 to before 5.18.187.328 custom
  • affected 5.18.187 to before 5.18.187.329 custom
  • affected 5.18.248 to before 5.18.248.31 custom
  • affected 5.23.8 to before 5.23.8.210 custom
  • affected 5.24.8 to before 5.24.8.26 custom
  • affected 5.25.92 to before 5.25.92.166 custom
  • affected 5.25.705 to before 5.25.705.21 custom
  • affected 5.25.713 to before 5.25.713.10 custom
  • affected 5.25.724 to before 5.25.724.5 custom
  • and 5 more
Other versions: unknown
WSO2 WSO2 Carbon Identity User Store Configuration UI Package name: org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui
  • affected 5.14.127 to before 5.14.127.13 custom
  • affected 5.17.5 to before 5.17.5.330 custom
  • affected 5.17.5 to before 5.17.5.331 custom
  • affected 5.17.118 to before 5.17.118.22 custom
  • affected 5.18.187 to before 5.18.187.328 custom
  • affected 5.18.187 to before 5.18.187.329 custom
  • affected 5.18.248 to before 5.18.248.31 custom
  • affected 5.23.8 to before 5.23.8.210 custom
  • affected 5.24.8 to before 5.24.8.26 custom
  • affected 5.25.92 to before 5.25.92.166 custom
  • affected 5.25.705 to before 5.25.705.21 custom
  • affected 5.25.713 to before 5.25.713.10 custom
  • and 6 more
Other versions: unknown
WSO2 WSO2 Carbon Registry Profiles UI Package name: org.wso2.carbon:org.wso2.carbon.registry.profiles.ui
  • affected 4.7.32 to before 4.7.32.18 custom
  • affected 4.7.33 to before 4.7.33.16 custom
  • affected 4.8.9 to before 4.8.9.16 custom
  • affected 4.8.12 to before 4.8.12.8 custom
  • affected 4.8.24 to before 4.8.24.6 custom
  • affected 4.8.43 to before 4.8.43.4 custom
  • affected 4.8.50 to before 4.8.50.3 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Registry Properties UI Package name: org.wso2.carbon:org.wso2.carbon.registry.properties.ui
  • affected 4.7.24 to before 4.7.24.11 custom
  • affected 4.7.32 to before 4.7.32.16 custom
  • affected 4.7.32 to before 4.7.32.18 custom
  • affected 4.7.33 to before 4.7.33.16 custom
  • affected 4.7.35 to before 4.7.35.15 custom
  • affected 4.7.39 to before 4.7.39.12 custom
  • affected 4.7.51 to before 4.7.51.8 custom
  • affected 4.8.3 to before 4.8.3.10 custom
  • affected 4.8.9 to before 4.8.9.16 custom
  • affected 4.8.12 to before 4.8.12.8 custom
  • affected 4.8.13 to before 4.8.13.9 custom
  • affected 4.8.24 to before 4.8.24.6 custom
  • and 7 more
Other versions: unknown
WSO2 WSO2 Carbon Registry Resources UI Package name: org.wso2.carbon:org.wso2.carbon.registry.resource.ui
  • affected 4.7.24 to before 4.7.24.11 custom
  • affected 4.7.32 to before 4.7.32.16 custom
  • affected 4.7.32 to before 4.7.32.18 custom
  • affected 4.7.33 to before 4.7.33.16 custom
  • affected 4.7.35 to before 4.7.35.15 custom
  • affected 4.7.39 to before 4.7.39.12 custom
  • affected 4.7.51 to before 4.7.51.8 custom
  • affected 4.8.3 to before 4.8.3.10 custom
  • affected 4.8.9 to before 4.8.9.16 custom
  • affected 4.8.12 to before 4.8.12.8 custom
  • affected 4.8.13 to before 4.8.13.9 custom
  • affected 4.8.24 to before 4.8.24.6 custom
  • and 7 more
Other versions: unknown
WSO2 WSO2 Carbon Registry Search UI Package name: org.wso2.carbon:org.wso2.carbon.registry.search.ui
  • affected 4.7.24 to before 4.7.24.11 custom
  • affected 4.7.32 to before 4.7.32.16 custom
  • affected 4.7.32 to before 4.7.32.18 custom
  • affected 4.7.33 to before 4.7.33.16 custom
  • affected 4.7.35 to before 4.7.35.15 custom
  • affected 4.7.39 to before 4.7.39.12 custom
  • affected 4.7.51 to before 4.7.51.8 custom
  • affected 4.8.3 to before 4.8.3.10 custom
  • affected 4.8.9 to before 4.8.9.16 custom
  • affected 4.8.12 to before 4.8.12.8 custom
  • affected 4.8.13 to before 4.8.13.9 custom
  • affected 4.8.24 to before 4.8.24.6 custom
  • and 1 more
Other versions: unknown
WSO2 WSO2 Stratos User Interface For Tenant CRUD Operations Package name: org.wso2.carbon:org.wso2.carbon.tenant.mgt.ui
  • affected 4.8.1 to before 4.8.1.6 custom
  • affected 4.8.7 to before 4.8.7.3 custom
  • affected 4.9.8 to before 4.9.8.7 custom
  • affected 4.9.10 to before 4.9.10.7 custom
  • affected 4.9.10 to before 4.9.10.8 custom
  • affected 4.9.20 to before 4.9.20.5 custom
  • affected 4.9.27 to before 4.9.27.1 custom
  • affected 4.9.31 to before 4.9.31.1 custom
  • affected 4.9.34 to before 4.9.34.1 custom
  • affected 4.9.42 to before 4.9.42.1 custom
  • affected 4.11.0 to before 4.11.0.7 custom
  • affected 4.11.19 to before 4.11.19.4 custom
  • and 3 more
Other versions: unknown
WSO2 WSO2 Stratos SSO Redirector UI Component Package name: org.wso2.carbon.multitenancy:org.wso2.carbon.tenant.sso.redirector.ui
  • affected 4.8.1 to before 4.8.1.6 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Email Verification UI Package name: org.wso2.carbon:org.wso2.carbon.email.verification.ui
  • affected 4.7.19 to before 4.7.19.14 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Event Simulator UI Package name: org.wso2.carbon:org.wso2.carbon.event.simulator.ui
  • affected 2.2.11 to before 2.2.11.1 custom
  • affected 2.2.14 to before 2.2.14.11 custom
  • affected 2.2.14 to before 2.2.14.12 custom
  • affected 2.2.17 to before 2.2.17.5 custom
  • affected 2.3.1 to before 2.3.1.4 custom
  • affected 2.3.5 to before 2.3.5.6 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Execution Manager UI Package name: org.wso2.carbon.analytics-common:org.wso2.carbon.event.template.manager.ui
  • affected 5.2.24 to before 5.2.24.10 custom
  • affected 5.2.26 to before 5.2.26.22 custom
  • affected 5.2.34 to before 5.2.34.12 custom
  • affected 5.2.41 to before 5.2.41.7 custom
  • affected 5.2.57 to before 5.2.57.10 custom
  • affected 5.3.5 to before 5.3.5.9 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Governance Custom Lifecycle Checklist UI Package name: org.wso2.carbon.governance:org.wso2.carbon.governance.custom.lifecycles.checklist.ui
  • affected 4.8.14 to before 4.8.14.4 custom
  • affected 4.8.19 to before 4.8.19.8 custom
  • affected 4.8.21 to before 4.8.21.10 custom
  • affected 4.8.28 to before 4.8.28.4 custom
  • affected 4.8.30 to before 4.8.30.6 custom
  • affected 4.8.32 to before 4.8.32.4 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Governance Generic Artifact User Interface Package name: org.wso2.carbon.governance:org.wso2.carbon.governance.generic.ui
  • affected 4.8.14 to before 4.8.14.4 custom
  • affected 4.8.19 to before 4.8.19.8 custom
  • affected 4.8.21 to before 4.8.21.10 custom
  • affected 4.8.28 to before 4.8.28.4 custom
  • affected 4.8.30 to before 4.8.30.6 custom
  • affected 4.8.32 to before 4.8.32.4 custom
  • affected 4.8.33 to before 4.8.33.4 custom
  • affected 4.8.34 to before 4.8.34.5 custom
  • affected 4.8.37 to before 4.8.37.4 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Governance Life Cycles User Interface Package name: org.wso2.carbon.governance:org.wso2.carbon.governance.lcm.ui
  • affected 4.8.14 to before 4.8.14.4 custom
  • affected 4.8.19 to before 4.8.19.8 custom
  • affected 4.8.21 to before 4.8.21.10 custom
  • affected 4.8.28 to before 4.8.28.4 custom
  • affected 4.8.30 to before 4.8.30.6 custom
  • affected 4.8.32 to before 4.8.32.4 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Governance WSDL Tool UI Package name: org.wso2.carbon:org.wso2.carbon.governance.wsdltool.ui
  • affected 4.8.14 to before 4.8.14.4 custom
  • affected 4.8.19 to before 4.8.19.8 custom
  • affected 4.8.21 to before 4.8.21.10 custom
  • affected 4.8.28 to before 4.8.28.4 custom
  • affected 4.8.30 to before 4.8.30.6 custom
  • affected 4.8.32 to before 4.8.32.4 custom
  • affected 4.8.33 to before 4.8.33.4 custom
  • affected 4.8.34 to before 4.8.34.5 custom
  • affected 4.8.37 to before 4.8.37.4 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon New Data Sources UI Package name: org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui
  • affected 4.7.19 to before 4.7.19.13 custom
  • affected 4.7.24 to before 4.7.24.5 custom
  • affected 4.7.32 to before 4.7.32.10 custom
  • affected 4.7.35 to before 4.7.35.13 custom
  • affected 4.7.49 to before 4.7.49.7 custom
  • affected 4.7.52 to before 4.7.52.5 custom
  • affected 4.9.2 to before 4.9.2.8 custom
  • affected 4.9.11 to before 4.9.11.2 custom
  • affected 4.9.18 to before 4.9.18.1 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Registry Info UI2 Package name: org.wso2.carbon:org.wso2.carbon.registry.info.ui
  • affected 4.7.32 to before 4.7.32.16 custom
  • affected 4.7.35 to before 4.7.35.15 custom
  • affected 4.7.39 to before 4.7.39.12 custom
  • affected 4.7.51 to before 4.7.51.8 custom
  • affected 4.8.3 to before 4.8.3.10 custom
  • affected 4.8.13 to before 4.8.13.9 custom
  • affected 4.8.32 to before 4.8.32.4 custom
  • affected 4.8.36 to before 4.8.36.2 custom
  • affected 4.8.43 to before 4.8.43.2 custom
  • affected 4.8.50 to before 4.8.50.1 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Registry Relations UI Package name: org.wso2.carbon:org.wso2.carbon.registry.relations.ui
  • affected 4.7.24 to before 4.7.24.11 custom
  • affected 4.7.32 to before 4.7.32.16 custom
  • affected 4.7.35 to before 4.7.35.15 custom
  • affected 4.7.39 to before 4.7.39.12 custom
  • affected 4.7.51 to before 4.7.51.8 custom
  • affected 4.8.3 to before 4.8.3.10 custom
  • affected 4.8.13 to before 4.8.13.9 custom
  • affected 4.8.32 to before 4.8.32.4 custom
  • affected 4.8.36 to before 4.8.36.2 custom
  • affected 4.8.43 to before 4.8.43.2 custom
  • affected 4.8.50 to before 4.8.50.1 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Registry Indexing Package name: org.wso2.carbon.registry:org.wso2.carbon.registry.indexing
  • affected 4.7 to before 4.7.24 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Security UI Package name: org.wso2.carbon:org.wso2.carbon.security.mgt.ui
  • affected 5.14 to before 5.14.127 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Component Andes Event UI Package name: org.wso2.carbon.messaging:org.wso2.carbon.andes.event.ui
  • affected 3.3.12 to before 3.3.12.3 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Component Andes UI1 Package name: org.wso2.carbon.messaging:org.wso2.carbon.andes.ui
  • affected 3.3.12 to before 3.3.12.3 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon HL7 Business Messaging Store UI Package name: org.wso2.carbon.mediation:org.wso2.carbon.business.messaging.hl7.store.ui
  • affected 4.7.30 to before 4.7.30.53 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Endpoint Editor UI Package name: org.wso2.carbonorg.wso2.carbon.endpoint.ui
  • affected 4.7.30 to before 4.7.30.53 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Publish Event Mediator Configuration UI Package name: org.wso2.carbon.mediationorg.wso2.carbon.event.sink.config.ui
  • affected 4.7.30 to before 4.7.30.53 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Eventing UI Package name: org.wso2.carbon.commons:org.wso2.carbon.event.ui
  • affected 4.7.19 to before 4.7.19.13 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon HumanTask UI Package name: org.wso2.carbon.business-process:org.wso2.carbon.humantask.ui
  • affected 4.5.27 to before 4.5.27.10 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Logging UI Package name: org.wso2.carbon:org.wso2.carbon.logging.admin.ui
  • affected 4.7.19 to before 4.7.19.13 custom
  • affected 4.7.24 to before 4.7.24.5 custom
  • affected 4.7.32 to before 4.7.32.10 custom
  • affected 4.7.52 to before 4.7.52.5 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Template Editor UI Package name: org.wso2.carbon.mediation:org.wso2.carbon.mediation.templates.ui
  • affected 4.7.30 to before 4.7.30.53 custom
  • unaffected x to *, inclusive custom
Other versions: unknown
WSO2 WSO2 Carbon Command Mediator UI Package name: org.wso2.carbon:org.wso2.carbon.mediator.command.ui
  • affected 4.7.30 to before 4.7.30.53 custom
  • unaffected x to *, inclusive custom
Other versions: unknown

And 7 more products. The full list is on the CVE record.

Identifiers
CVE-2025-13394
CNA
WSO2
Weakness (CWE)
CWE-352
Tags
Published
6 Aug 2026
Updated
6 Aug 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
5.4 Medium 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L CNA (WSO2)
  • CISA KEV Not listed.
  • EPSS 0.0014, the 3rd percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 6 Aug 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.