CVE-2025-6670

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-6670
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6670.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-6670
Published
2025-11-18T12:15:46.420Z
Modified
2026-07-08T08:08:13.214872788Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event processor of the Carbon console. Although the SameSite=Lax cookie attribute is used as a mitigation, it is ineffective in this context because it allows cookies to be sent with cross-origin top-level navigations using GET requests.

A malicious actor can exploit this vulnerability by tricking an authenticated user into visiting a crafted link, leading the browser to issue unintended state-changing requests. Successful exploitation could result in unauthorized operations such as data modification, account changes, or other administrative actions. According to WSO2 Secure Production Guidelines, exposure of Carbon console services to untrusted networks is discouraged, which may reduce the impact in properly secured deployments.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_control_plane:4.6.0:-:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "4.5.0-NA"
                },
                {
                    "last_affected": "4.5.0-NA"
                },
                {
                    "introduced": "4.6.0-NA"
                },
                {
                    "last_affected": "4.6.0-NA"
                }
            ],
            "vendor_product": "wso2:api_control_plane",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "3.2.1"
                },
                {
                    "last_affected": "3.2.1"
                }
            ],
            "vendor_product": "wso2:api_manager",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:7.2.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                },
                {
                    "introduced": "5.11.0"
                },
                {
                    "last_affected": "5.11.0"
                },
                {
                    "introduced": "6.0.0-NA"
                },
                {
                    "last_affected": "6.0.0-NA"
                },
                {
                    "introduced": "6.1.0-NA"
                },
                {
                    "last_affected": "6.1.0-NA"
                },
                {
                    "introduced": "7.0.0-NA"
                },
                {
                    "last_affected": "7.0.0-NA"
                },
                {
                    "introduced": "7.1.0-NA"
                },
                {
                    "last_affected": "7.1.0-NA"
                },
                {
                    "introduced": "7.2.0"
                },
                {
                    "last_affected": "7.2.0"
                }
            ],
            "vendor_product": "wso2:identity_server",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "wso2:identity_server_as_key_manager",
            "extracted_events": [
                {
                    "introduced": "5.10.0"
                },
                {
                    "last_affected": "5.10.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "wso2:open_banking_am",
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.0.0"
                }
            ],
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "2.0.0"
                },
                {
                    "last_affected": "2.0.0"
                }
            ],
            "vendor_product": "wso2:open_banking_iam",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:traffic_manager:4.6.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                },
                {
                    "introduced": "4.6.0"
                },
                {
                    "last_affected": "4.6.0"
                }
            ],
            "vendor_product": "wso2:traffic_manager",
            "source": "CPE_STRING"
        },
        {
            "cpes": [
                "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:universal_gateway:4.6.0:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.0"
                },
                {
                    "introduced": "4.6.0"
                },
                {
                    "last_affected": "4.6.0"
                }
            ],
            "vendor_product": "wso2:universal_gateway",
            "source": "CPE_STRING"
        }
    ]
}
References

Affected packages

Git / github.com/wso2/product-apim

Affected ranges

Type
GIT
Repo
https://github.com/wso2/product-apim
Events
Introduced
2971de274564b622974de831403e9688a4a76c14
Last affected
8cc6ee54401aa3e3281cd7aeded278c9b7ed6988
Database specific 
{
    "cpe": [
        "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.6.0:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "3.1.0"
        },
        {
            "last_affected": "3.1.0"
        },
        {
            "introduced": "3.2.0"
        },
        {
            "last_affected": "3.2.0"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "last_affected": "4.0.0"
        },
        {
            "introduced": "4.1.0-NA"
        },
        {
            "last_affected": "4.1.0-NA"
        },
        {
            "introduced": "4.2.0-NA"
        },
        {
            "last_affected": "4.2.0-NA"
        },
        {
            "introduced": "4.3.0-NA"
        },
        {
            "last_affected": "4.3.0-NA"
        },
        {
            "introduced": "4.4.0-NA"
        },
        {
            "last_affected": "4.4.0-NA"
        },
        {
            "introduced": "4.5.0-NA"
        },
        {
            "last_affected": "4.5.0-NA"
        },
        {
            "introduced": "4.6.0-NA"
        },
        {
            "last_affected": "4.6.0-NA"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

3.*
3.1.0
3.2.0
4.*
4.0.0
4.0.0-beta
4.1.0-NA
4.2.0-NA
4.3.0-NA
4.4.0-NA
4.5.0-NA
4.6.0-NA
v3.*
v3.1.0
v3.1.0-rc3
v3.2.0
v3.2.0-alpha
v3.2.0-beta
v3.2.0-m1
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.2.0-rc4
v3.2.0-rc5
v3.2.0-rc6
v4.*
v4.0.0
v4.0.0-alpha
v4.0.0-beta
v4.0.0-m1
v4.0.0-m2
v4.0.0-m3
v4.0.0-m4
v4.0.0-m5
v4.0.0-m6
v4.0.0-m7
v4.0.0-m8
v4.0.0-rc
v4.1.0
v4.1.0-alpha
v4.1.0-beta
v4.1.0-m1
v4.1.0-m2
v4.1.0-m3
v4.1.0-m4
v4.1.0-rc
v4.1.0-rc2
v4.1.0-rc3
v4.2.0
v4.2.0-alpha
v4.2.0-beta
v4.2.0-m1
v4.2.0-rc
v4.2.0-rc2
v4.3.0
v4.3.0-alpha
v4.3.0-alpha2
v4.3.0-beta
v4.3.0-m2
v4.3.0-rc
v4.3.0-rc2
v4.4.0
v4.4.0-alpha
v4.4.0-beta
v4.4.0-m1
v4.4.0-rc
v4.4.0-rc2
v4.5.0
v4.5.0-acp
v4.5.0-acp-alpha
v4.5.0-acp-beta
v4.5.0-acp-m1
v4.5.0-acp-rc
v4.5.0-acp-rc2
v4.5.0-beta
v4.5.0-gw
v4.5.0-gw-alpha
v4.5.0-gw-beta
v4.5.0-gw-m1
v4.5.0-gw-rc
v4.5.0-gw-rc2
v4.5.0-m1
v4.5.0-m2
v4.5.0-rc
v4.5.0-rc2
v4.5.0-tm
v4.5.0-tm-alpha
v4.5.0-tm-beta
v4.5.0-tm-m1
v4.5.0-tm-rc
v4.5.0-tm-rc2
v4.6.0
v4.6.0-acp-alpha
v4.6.0-acp-alpha2
v4.6.0-acp-alpha3
v4.6.0-acp-beta
v4.6.0-acp-m1
v4.6.0-acp-rc
v4.6.0-acp-rc2
v4.6.0-acp-rc3
v4.6.0-alpha
v4.6.0-alpha2
v4.6.0-alpha3
v4.6.0-beta
v4.6.0-gw-alpha
v4.6.0-gw-alpha2
v4.6.0-gw-alpha3
v4.6.0-gw-beta
v4.6.0-gw-m1
v4.6.0-gw-rc
v4.6.0-gw-rc2
v4.6.0-gw-rc3
v4.6.0-m1
v4.6.0-rc
v4.6.0-rc2
v4.6.0-rc3
v4.6.0-rc4
v4.6.0-tm
v4.6.0-tm-alpha
v4.6.0-tm-alpha2
v4.6.0-tm-alpha3
v4.6.0-tm-beta
v4.6.0-tm-m1
v4.6.0-tm-rc
v4.6.0-tm-rc2
v4.6.0-tm-rc3
v4.6.0-tm-rc4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6670.json"

Git / github.com/wso2/product-ei

Affected ranges

Type
GIT
Repo
https://github.com/wso2/product-ei
Events
Introduced
bfdf341ab6dcfccce35c88b8a1567604f07ba8f5
Last affected
bfdf341ab6dcfccce35c88b8a1567604f07ba8f5
Database specific 
{
    "cpe": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.6.0"
        },
        {
            "last_affected": "6.6.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

6.*
6.6.0
v6.*
v6.6.0
v6.6.0-rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-6670.json"