5.4
MEDIUM
CVSS 3.1
CVE-2025-13394
Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions
Overview
Description
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.
Details
INFO
Published Date :
Aug. 6, 2026, 8:16 a.m.
Last Modified :
Aug. 6, 2026, 8:16 a.m.
Remotely Exploit :
Yes !
Source :
ed10eef1-636d-4fbe-9993-6890dfa878f8
Impact
Affected Products
The following products are affected by CVE-2025-13394
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | ed10eef1-636d-4fbe-9993-6890dfa878f8 | ||||
| CVSS 3.1 | MEDIUM | MITRE-CVE |
Solution
Prevent CSRF by validating origin and using POST requests for state-changing operations.
- Validate the Origin header for state-changing requests.
- Use HTTP POST for state-changing operations.
- Implement anti-CSRF tokens for all state-changing requests.
- Update the Carbon console to the latest secure version.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-13394.
| URL | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/ |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-13394 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-13394
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-13394 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-13394 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by ed10eef1-636d-4fbe-9993-6890dfa878f8
Aug. 06, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'WSO2', 'product': 'WSO2 Identity Server', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '5.10.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.10.0', 'lessThan': '5.10.0.381', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.11.0', 'lessThan': '5.11.0.428', 'versionType': 'custom'}, {'status': 'affected', 'version': '6.0.0', 'lessThan': '6.0.0.255', 'versionType': 'custom'}, {'status': 'affected', 'version': '6.1.0', 'lessThan': '6.1.0.256', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.0.0', 'lessThan': '7.0.0.133', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.1.0', 'lessThan': '7.1.0.41', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.2.0', 'lessThan': '7.2.0.3', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 API Manager', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '3.1.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '3.1.0', 'lessThan': '3.1.0.352', 'versionType': 'custom'}, {'status': 'affected', 'version': '3.2.0', 'lessThan': '3.2.0.456', 'versionType': 'custom'}, {'status': 'affected', 'version': '3.2.1', 'lessThan': '3.2.1.75', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.0.0', 'lessThan': '4.0.0.376', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.1.0', 'lessThan': '4.1.0.239', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.2.0', 'lessThan': '4.2.0.179', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.3.0', 'lessThan': '4.3.0.91', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.4.0', 'lessThan': '4.4.0.55', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.5.0', 'lessThan': '4.5.0.38', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.6.0', 'lessThan': '4.6.0.3', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 Open Banking IAM', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '2.0.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '2.0.0', 'lessThan': '2.0.0.421', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 Open Banking AM', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '2.0.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '2.0.0', 'lessThan': '2.0.0.401', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 Identity Server as Key Manager', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '5.10.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.10.0', 'lessThan': '5.10.0.372', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 API Control Plane', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '4.5.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.5.0', 'lessThan': '4.5.0.39', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.6.0', 'lessThan': '4.6.0.3', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 Universal Gateway', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '4.5.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.5.0', 'lessThan': '4.5.0.37', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.6.0', 'lessThan': '4.6.0.3', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 Traffic Manager', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '4.5.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.5.0', 'lessThan': '4.5.0.37', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.6.0', 'lessThan': '4.6.0.3', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 Enterprise Integrator', 'versions': [{'status': 'unknown', 'version': '0', 'lessThan': '6.6.0', 'versionType': 'custom'}, {'status': 'affected', 'version': '6.6.0', 'lessThan': '6.6.0.227', 'versionType': 'custom'}], 'defaultStatus': 'unaffected'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Identity Entitlement UI', 'versions': [{'status': 'affected', 'version': '5.17.5', 'lessThan': '5.17.5.331', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.18.187', 'lessThan': '5.18.187.329', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.23.8', 'lessThan': '5.23.8.210', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.92', 'lessThan': '5.25.92.166', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.0.78', 'lessThan': '7.0.78.157', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.identity.framework:org.wso2.carbon.identity.entitlement.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Identity Management UI1', 'versions': [{'status': 'affected', 'version': '5.17.5', 'lessThan': '5.17.5.330', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.17.5', 'lessThan': '5.17.5.331', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.17.118', 'lessThan': '5.17.118.22', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.18.187', 'lessThan': '5.18.187.328', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.18.187', 'lessThan': '5.18.187.329', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.18.248', 'lessThan': '5.18.248.31', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.23.8', 'lessThan': '5.23.8.210', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.24.8', 'lessThan': '5.24.8.26', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.92', 'lessThan': '5.25.92.166', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.705', 'lessThan': '5.25.705.21', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.713', 'lessThan': '5.25.713.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.724', 'lessThan': '5.25.724.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.736', 'lessThan': '5.25.736.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.0.78', 'lessThan': '7.0.78.157', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.8.23', 'lessThan': '7.8.23.67', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.8.586', 'lessThan': '7.8.586.7', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.identity.framework:org.wso2.carbon.identity.mgt.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Identity User Store Configuration UI', 'versions': [{'status': 'affected', 'version': '5.14.127', 'lessThan': '5.14.127.13', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.17.5', 'lessThan': '5.17.5.330', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.17.5', 'lessThan': '5.17.5.331', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.17.118', 'lessThan': '5.17.118.22', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.18.187', 'lessThan': '5.18.187.328', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.18.187', 'lessThan': '5.18.187.329', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.18.248', 'lessThan': '5.18.248.31', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.23.8', 'lessThan': '5.23.8.210', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.24.8', 'lessThan': '5.24.8.26', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.92', 'lessThan': '5.25.92.166', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.705', 'lessThan': '5.25.705.21', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.713', 'lessThan': '5.25.713.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.724', 'lessThan': '5.25.724.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.25.736', 'lessThan': '5.25.736.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.0.78', 'lessThan': '7.0.78.157', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.8.23', 'lessThan': '7.8.23.67', 'versionType': 'custom'}, {'status': 'affected', 'version': '7.8.586', 'lessThan': '7.8.586.7', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Registry Profiles UI', 'versions': [{'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.18', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.33', 'lessThan': '4.7.33.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.9', 'lessThan': '4.8.9.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.12', 'lessThan': '4.8.12.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.24', 'lessThan': '4.8.24.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.43', 'lessThan': '4.8.43.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.50', 'lessThan': '4.8.50.3', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.registry.profiles.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Registry Properties UI', 'versions': [{'status': 'affected', 'version': '4.7.24', 'lessThan': '4.7.24.11', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.18', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.33', 'lessThan': '4.7.33.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.35', 'lessThan': '4.7.35.15', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.39', 'lessThan': '4.7.39.12', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.51', 'lessThan': '4.7.51.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.3', 'lessThan': '4.8.3.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.9', 'lessThan': '4.8.9.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.12', 'lessThan': '4.8.12.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.13', 'lessThan': '4.8.13.9', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.24', 'lessThan': '4.8.24.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.36', 'lessThan': '4.8.36.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.43', 'lessThan': '4.8.43.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.43', 'lessThan': '4.8.43.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.50', 'lessThan': '4.8.50.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.50', 'lessThan': '4.8.50.3', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.registry.properties.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Registry Resources UI', 'versions': [{'status': 'affected', 'version': '4.7.24', 'lessThan': '4.7.24.11', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.18', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.33', 'lessThan': '4.7.33.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.35', 'lessThan': '4.7.35.15', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.39', 'lessThan': '4.7.39.12', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.51', 'lessThan': '4.7.51.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.3', 'lessThan': '4.8.3.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.9', 'lessThan': '4.8.9.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.12', 'lessThan': '4.8.12.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.13', 'lessThan': '4.8.13.9', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.24', 'lessThan': '4.8.24.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.36', 'lessThan': '4.8.36.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.43', 'lessThan': '4.8.43.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.43', 'lessThan': '4.8.43.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.50', 'lessThan': '4.8.50.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.50', 'lessThan': '4.8.50.3', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.registry.resource.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Registry Search UI', 'versions': [{'status': 'affected', 'version': '4.7.24', 'lessThan': '4.7.24.11', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.18', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.33', 'lessThan': '4.7.33.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.35', 'lessThan': '4.7.35.15', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.39', 'lessThan': '4.7.39.12', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.51', 'lessThan': '4.7.51.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.3', 'lessThan': '4.8.3.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.9', 'lessThan': '4.8.9.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.12', 'lessThan': '4.8.12.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.13', 'lessThan': '4.8.13.9', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.24', 'lessThan': '4.8.24.6', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.registry.search.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Stratos User Interface For Tenant CRUD Operations', 'versions': [{'status': 'affected', 'version': '4.8.1', 'lessThan': '4.8.1.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.7', 'lessThan': '4.8.7.3', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.8', 'lessThan': '4.9.8.7', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.10', 'lessThan': '4.9.10.7', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.10', 'lessThan': '4.9.10.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.20', 'lessThan': '4.9.20.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.27', 'lessThan': '4.9.27.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.31', 'lessThan': '4.9.31.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.34', 'lessThan': '4.9.34.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.42', 'lessThan': '4.9.42.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.11.0', 'lessThan': '4.11.0.7', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.11.19', 'lessThan': '4.11.19.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.11.34', 'lessThan': '4.11.34.3', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.11.45', 'lessThan': '4.11.45.1', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.tenant.mgt.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Stratos SSO Redirector UI Component', 'versions': [{'status': 'affected', 'version': '4.8.1', 'lessThan': '4.8.1.6', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.multitenancy:org.wso2.carbon.tenant.sso.redirector.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Email Verification UI', 'versions': [{'status': 'affected', 'version': '4.7.19', 'lessThan': '4.7.19.14', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.email.verification.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Event Simulator UI', 'versions': [{'status': 'affected', 'version': '2.2.11', 'lessThan': '2.2.11.1', 'versionType': 'custom'}, {'status': 'affected', 'version': '2.2.14', 'lessThan': '2.2.14.11', 'versionType': 'custom'}, {'status': 'affected', 'version': '2.2.14', 'lessThan': '2.2.14.12', 'versionType': 'custom'}, {'status': 'affected', 'version': '2.2.17', 'lessThan': '2.2.17.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '2.3.1', 'lessThan': '2.3.1.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '2.3.5', 'lessThan': '2.3.5.6', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.event.simulator.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Execution Manager UI', 'versions': [{'status': 'affected', 'version': '5.2.24', 'lessThan': '5.2.24.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.2.26', 'lessThan': '5.2.26.22', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.2.34', 'lessThan': '5.2.34.12', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.2.41', 'lessThan': '5.2.41.7', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.2.57', 'lessThan': '5.2.57.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '5.3.5', 'lessThan': '5.3.5.9', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.analytics-common:org.wso2.carbon.event.template.manager.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Governance Custom Lifecycle Checklist UI', 'versions': [{'status': 'affected', 'version': '4.8.14', 'lessThan': '4.8.14.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.19', 'lessThan': '4.8.19.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.21', 'lessThan': '4.8.21.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.28', 'lessThan': '4.8.28.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.30', 'lessThan': '4.8.30.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.governance:org.wso2.carbon.governance.custom.lifecycles.checklist.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Governance Generic Artifact User Interface', 'versions': [{'status': 'affected', 'version': '4.8.14', 'lessThan': '4.8.14.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.19', 'lessThan': '4.8.19.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.21', 'lessThan': '4.8.21.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.28', 'lessThan': '4.8.28.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.30', 'lessThan': '4.8.30.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.33', 'lessThan': '4.8.33.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.34', 'lessThan': '4.8.34.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.37', 'lessThan': '4.8.37.4', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.governance:org.wso2.carbon.governance.generic.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Governance Life Cycles User Interface', 'versions': [{'status': 'affected', 'version': '4.8.14', 'lessThan': '4.8.14.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.19', 'lessThan': '4.8.19.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.21', 'lessThan': '4.8.21.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.28', 'lessThan': '4.8.28.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.30', 'lessThan': '4.8.30.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.governance:org.wso2.carbon.governance.lcm.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Governance WSDL Tool UI', 'versions': [{'status': 'affected', 'version': '4.8.14', 'lessThan': '4.8.14.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.19', 'lessThan': '4.8.19.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.21', 'lessThan': '4.8.21.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.28', 'lessThan': '4.8.28.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.30', 'lessThan': '4.8.30.6', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.33', 'lessThan': '4.8.33.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.34', 'lessThan': '4.8.34.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.37', 'lessThan': '4.8.37.4', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.governance.wsdltool.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon New Data Sources UI', 'versions': [{'status': 'affected', 'version': '4.7.19', 'lessThan': '4.7.19.13', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.24', 'lessThan': '4.7.24.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.35', 'lessThan': '4.7.35.13', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.49', 'lessThan': '4.7.49.7', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.52', 'lessThan': '4.7.52.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.2', 'lessThan': '4.9.2.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.11', 'lessThan': '4.9.11.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.9.18', 'lessThan': '4.9.18.1', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.commons:org.wso2.carbon.ndatasource.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Registry Info UI2', 'versions': [{'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.35', 'lessThan': '4.7.35.15', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.39', 'lessThan': '4.7.39.12', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.51', 'lessThan': '4.7.51.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.3', 'lessThan': '4.8.3.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.13', 'lessThan': '4.8.13.9', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.36', 'lessThan': '4.8.36.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.43', 'lessThan': '4.8.43.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.50', 'lessThan': '4.8.50.1', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.registry.info.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Registry Relations UI', 'versions': [{'status': 'affected', 'version': '4.7.24', 'lessThan': '4.7.24.11', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.16', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.35', 'lessThan': '4.7.35.15', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.39', 'lessThan': '4.7.39.12', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.51', 'lessThan': '4.7.51.8', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.3', 'lessThan': '4.8.3.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.13', 'lessThan': '4.8.13.9', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.32', 'lessThan': '4.8.32.4', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.36', 'lessThan': '4.8.36.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.43', 'lessThan': '4.8.43.2', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.8.50', 'lessThan': '4.8.50.1', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.registry.relations.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Registry Indexing', 'versions': [{'status': 'affected', 'version': '4.7', 'lessThan': '4.7.24', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.registry:org.wso2.carbon.registry.indexing', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Security UI', 'versions': [{'status': 'affected', 'version': '5.14', 'lessThan': '5.14.127', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.security.mgt.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Component Andes Event UI', 'versions': [{'status': 'affected', 'version': '3.3.12', 'lessThan': '3.3.12.3', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.messaging:org.wso2.carbon.andes.event.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Component Andes UI1', 'versions': [{'status': 'affected', 'version': '3.3.12', 'lessThan': '3.3.12.3', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.messaging:org.wso2.carbon.andes.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon HL7 Business Messaging Store UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.mediation:org.wso2.carbon.business.messaging.hl7.store.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Endpoint Editor UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbonorg.wso2.carbon.endpoint.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Publish Event Mediator Configuration UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.mediationorg.wso2.carbon.event.sink.config.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Eventing UI', 'versions': [{'status': 'affected', 'version': '4.7.19', 'lessThan': '4.7.19.13', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.commons:org.wso2.carbon.event.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon HumanTask UI', 'versions': [{'status': 'affected', 'version': '4.5.27', 'lessThan': '4.5.27.10', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.business-process:org.wso2.carbon.humantask.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Logging UI', 'versions': [{'status': 'affected', 'version': '4.7.19', 'lessThan': '4.7.19.13', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.24', 'lessThan': '4.7.24.5', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.32', 'lessThan': '4.7.32.10', 'versionType': 'custom'}, {'status': 'affected', 'version': '4.7.52', 'lessThan': '4.7.52.5', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.logging.admin.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Template Editor UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.mediation:org.wso2.carbon.mediation.templates.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Command Mediator UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.mediator.command.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Rule Mediator UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.mediator.rule.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Throttle Mediator UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.mediator.throttle.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Tasks Core', 'versions': [{'status': 'affected', 'version': '4.7.19', 'lessThan': '4.7.19.13', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.ntask.core', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Rest API Admin UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.rest.api.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Sequence Editor UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.sequences.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Task UI', 'versions': [{'status': 'affected', 'version': '4.7.30', 'lessThan': '4.7.30.53', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon:org.wso2.carbon.task.ui', 'defaultStatus': 'unknown'}, {'vendor': 'WSO2', 'product': 'WSO2 Carbon Governance', 'versions': [{'status': 'affected', 'version': '4.8.37', 'lessThan': '4.8.37.4', 'versionType': 'custom'}, {'status': 'unaffected', 'version': 'x', 'versionType': 'custom', 'lessThanOrEqual': '*'}], 'packageName': 'org.wso2.carbon.governance:org.wso2.carbon.governance.api', 'defaultStatus': 'unknown'}] Added Description The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Added CWE CWE-352 Added Reference https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.