Advisories · Technology

WSO2 Enterprise Integrator.

Every CVE that names WSO2 Enterprise Integrator among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2024-2372 CVE record

CVSS 5.4 Medium

Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
- WSO2 Open Banking AM
- WSO2 API Manager
- Open redirect
Not analysed yet 2 Nov 2026
CVE-2024-7075 CVE record

CVSS 4.6 Medium

Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 2 Nov 2026
CVE-2024-5139 CVE record

CVSS 6.1 Medium

Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Cross-site scripting (XSS)
Not analysed yet 21 Oct 2026
CVE-2024-2323 CVE record

CVSS 4.8 Medium

Password Brute Force via Password History Validation in Multiple WSO2 Products Allows User Account Discovery
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Authentication bypass
Not analysed yet 20 Oct 2026
CVE-2024-4412 CVE record

CVSS 2.7 Low

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Code injection
Not analysed yet 19 Oct 2026
CVE-2024-4457 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Remote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Command injection
Not analysed yet 18 Oct 2026
CVE-2025-12317 CVE record

CVSS 5.0 Medium

Improper Token Revocation via SOAP Services in Multiple WSO2 Products Allows Retained Access Privileges
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Authentication bypass
Not analysed yet 6 Aug 2026
CVE-2024-6541 CVE record

CVSS 6.8 Medium

Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
- WSO2 Micro Integrator
- WSO2 Enterprise Integrator
- CWE-20
Not analysed yet 6 Aug 2026
CVE-2025-13394 CVE record

CVSS 5.4 Medium

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
- WSO2 Identity Server
- WSO2 API Manager
- Cross-site request forgery (CSRF)
Not analysed yet 6 Aug 2026
CVE-2024-6832 CVE record

CVSS 5.9 Medium

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks
- WSO2 Enterprise Integrator
- WSO2 API Control Plane
- CWE-693
Not analysed yet 6 Aug 2026
CVE-2025-6670 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) in Multiple WSO2 Products via HTTP GET in Admin Services
- WSO2 Open Banking AM
- WSO2 Open Banking IAM
- Cross-site request forgery (CSRF)
Not analysed yet 18 Nov 2025
CVE-2025-10853 CVE record

CVSS 5.2 Medium

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
- WSO2 Open Banking IAM
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 5 Nov 2025
CVE-2025-11093 CVE record

CVSS 8.4 High

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
- WSO2 Micro Integrator
- WSO2 API Manager
- Code injection
Not analysed yet 5 Nov 2025
CVE-2025-10907 CVE record

CVSS 8.4 High

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Services Leading to Remote Code Execution
- WSO2 API Manager
- WSO2 Open Banking IAM
- Unrestricted file upload
Not analysed yet 5 Nov 2025
CVE-2025-3125 CVE record

CVSS 6.7 Medium

Authenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code Execution
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Unrestricted file upload
Not analysed yet 5 Nov 2025
CVE-2025-5605 CVE record

CVSS 4.3 Medium

Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Authentication bypass
Not analysed yet 24 Oct 2025
CVE-2025-5350 CVE record

CVSS 5.9 Medium

SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
- WSO2 Identity Server
- WSO2 Enterprise Integrator
- Cross-site scripting (XSS)
- Server-side request forgery (SSRF)
Not analysed yet 24 Oct 2025
CVE-2025-9804 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Improper Access Control in Multiple WSO2 Products via Internal SOAP Admin Services and System REST APIs
- WSO2 Identity Server as Key Manager
- WSO2 Identity Server
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2025-9955 CVE record

CVSS 5.7 Medium

Improper Access Control in WSO2 Enterprise Integrator Product via SOAP Admin Services for Logs and User-Store Configuration
- WSO2 Enterprise Integrator
- WSO2 Enterprise Service Bus
- Broken access control
Not analysed yet 16 Oct 2025
CVE-2025-1862 CVE record

CVSS 6.7 Medium

Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Unrestricted file upload
Not analysed yet 26 Sept 2025
CVE-2024-3511 CVE record

CVSS 4.3 Medium

Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Broken access control
Not analysed yet 23 Jun 2025
CVE-2024-3509 CVE record

CVSS 4.3 Medium

Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Cross-site scripting (XSS)
Not analysed yet 2 Jun 2025
CVE-2024-7074 CVE record

CVSS 6.8 Medium

Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Unrestricted file upload
Not analysed yet 2 Jun 2025
CVE-2024-0392 CVE record

CVSS 5.4 Medium

Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation
- WSO2 Enterprise Integrator
- Cross-site request forgery (CSRF)
Not analysed yet 27 Feb 2025