cve-2025-5605

MEDIUM CVSS 4.3 opencve
Description

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.

Timeline
Published
2025-10-24 10:15 UTC
Last Modified
2026-06-17
CVSS Details

CVSS details not available.

Affected Products

No product information available.

Weaknesses (CWE)
CWE-290
CVSS metrics
Version Base Severity Vector Exploitability Impact Source
3.1 4.3 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N mitre
3.1 4.3 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N nvd
3.1 4.3 MEDIUM CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N opencve
References

No references available.

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cve": "CVE-2025-5605",
  "enrichment": {
    "created": "2025-10-27T22:12:50.206787+00:00",
    "updated": "2025-10-27T22:12:50.206812+00:00",
    "vendors": [
      "wso2",
      "wso2$PRODUCT$api_control_plane",
      "wso2$PRODUCT$api_manager",
      "wso2$PRODUCT$carbon",
      "wso2$PRODUCT$enterprise_integrator",
      "wso2$PRODUCT$identity_server",
      "wso2$PRODUCT$identity_server_as_key_manager",
      "wso2$PRODUCT$open_banking_am",
      "wso2$PRODUCT$open_banking_iam",
      "wso2$PRODUCT$traffic_manager",
      "wso2$PRODUCT$universal_gateway"
    ]
  },
  "epss": {
    "score": 0.0085
  },
  "mitre": {
    "cpes": [],
    "created": "2025-10-24T10:09:59.591000+00:00",
    "description": "An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.\n\nThe known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 4.3,
        "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2025/5xxx/CVE-2025-5605.json",
    "references": [
      "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4115/"
    ],
    "title": "Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure",
    "updated": "2025-10-24T11:44:58.987000+00:00",
    "vendors": [],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*"
    ],
    "created": "2025-10-24T10:15:39.160000+00:00",
    "description": "An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.\n\nThe known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 4.3,
        "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2025/CVE-2025-5605.json",
    "references": [
      "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4115/"
    ],
    "title": null,
    "updated": "2026-06-17T09:48:16.013000+00:00",
    "vendors": [
      "wso2",
      "wso2$PRODUCT$api_control_plane",
      "wso2$PRODUCT$api_manager",
      "wso2$PRODUCT$enterprise_integrator",
      "wso2$PRODUCT$identity_server",
      "wso2$PRODUCT$identity_server_as_key_manager",
      "wso2$PRODUCT$open_banking_am",
      "wso2$PRODUCT$open_banking_iam",
      "wso2$PRODUCT$traffic_manager",
      "wso2$PRODUCT$universal_gateway"
    ],
    "weaknesses": [
      "CWE-290"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2025-10-24T10:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.\n\nThe known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.",
              "old": null
            },
            "type": "description"
          },
          {
            "details": {
              "new": "Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4115/"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 4.3,
                  "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "3f94c34e-f72b-4b91-9a9d-d9dd6bd87239"
      },
      {
        "created": "2025-10-24T12:15:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-290"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "partial"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "57c9f4f7-b95d-44d1-9863-a948a4f7d873"
      },
      {
        "created": "2025-10-27T22:30:00+00:00",
        "data": [
          {
            "details": [
              "wso2",
              "wso2$PRODUCT$api_control_plane",
              "wso2$PRODUCT$api_manager",
              "wso2$PRODUCT$carbon",
              "wso2$PRODUCT$enterprise_integrator",
              "wso2$PRODUCT$identity_server",
              "wso2$PRODUCT$identity_server_as_key_manager",
              "wso2$PRODUCT$open_banking_am",
              "wso2$PRODUCT$open_banking_iam",
              "wso2$PRODUCT$traffic_manager",
              "wso2$PRODUCT$universal_gateway"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "wso2",
                "wso2$PRODUCT$api_control_plane",
                "wso2$PRODUCT$api_manager",
                "wso2$PRODUCT$carbon",
                "wso2$PRODUCT$enterprise_integrator",
                "wso2$PRODUCT$identity_server",
                "wso2$PRODUCT$identity_server_as_key_manager",
                "wso2$PRODUCT$open_banking_am",
                "wso2$PRODUCT$open_banking_iam",
                "wso2$PRODUCT$traffic_manager",
                "wso2$PRODUCT$universal_gateway"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "166b9b1e-571d-458e-b78c-73042d2b59c0"
      },
      {
        "created": "2025-11-21T14:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          }
        ],
        "id": "8ecf0355-0b9d-4437-9389-dfafb490e882"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*"
      ],
      "providers": [
        "nvd"
      ]
    },
    "created": {
      "data": "2025-10-24T10:09:59.591000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.\n\nThe known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 4.3,
          "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.0085
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "partial"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4115/"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure",
      "provider": "mitre"
    },
    "updated": {
      "data": "2025-11-21T14:20:43.277000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "wso2",
        "wso2$PRODUCT$api_control_plane",
        "wso2$PRODUCT$api_manager",
        "wso2$PRODUCT$carbon",
        "wso2$PRODUCT$enterprise_integrator",
        "wso2$PRODUCT$identity_server",
        "wso2$PRODUCT$identity_server_as_key_manager",
        "wso2$PRODUCT$open_banking_am",
        "wso2$PRODUCT$open_banking_iam",
        "wso2$PRODUCT$traffic_manager",
        "wso2$PRODUCT$universal_gateway"
      ],
      "providers": [
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-290"
      ],
      "providers": [
        "nvd",
        "vulnrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2025-10-24T10:09:59.591000+00:00",
    "description": "An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.\n\nThe known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "partial"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": "Authentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information Disclosure",
    "updated": "2025-10-24T11:44:53.012000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2025/5xxx/CVE-2025-5605.json",
    "weaknesses": [
      "CWE-290"
    ]
  }
}
Enrichment data
EPSS
View JSON Download
CISA KEV
View JSON Download
Nuclei templates
View JSON Download
Aggregated bundle (all enrichments)
View JSON API Download bundle
View JSON API Download JSON