CVE-2025-5717

{"id": "CVE-2025-5717", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-5717", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T18:31:28.992929Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.0.0", "versionType": "custom"}, {"status": "affected", "version": "3.0.0", "lessThan": "3.0.0.174", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.330", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.426", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.46", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.344", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.208", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.147", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.59", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.22", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.379", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "Siddhi Extension Evaluate Scripts", "versions": [{"status": "affected", "version": "3.2.6", "lessThan": "3.2.6.8", "versionType": "custom"}, {"status": "affected", "version": "3.2.7", "lessThan": "3.2.7.6", "versionType": "custom"}, {"status": "affected", "version": "3.2.8", "lessThan": "3.2.8.3", "versionType": "custom"}, {"status": "affected", "version": "3.2.10", "lessThan": "3.2.10.1", "versionType": "custom"}, {"status": "affected", "version": "3.2.13", "lessThan": "3.2.13.2", "versionType": "custom"}, {"status": "affected", "version": "3.2.14", "lessThan": "3.2.14.1", "versionType": "custom"}, {"status": "unaffected", "version": "3.2.15", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.siddhi:siddhi-extension-eval-scriptApache", "defaultStatus": "unknown"}]}], "published": "2025-09-23T16:15:33.620", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.\n\nExploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users."}, {"lang": "es", "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) autenticada en m\u00faltiples productos WSO2 debido a una validaci\u00f3n de entrada incorrecta en el servicio de administraci\u00f3n del procesador de eventos. Un usuario con acceso administrativo a los servicios de administraci\u00f3n SOAP puede explotar esta falla mediante el despliegue de un plan de ejecuci\u00f3n Siddhi que contenga c\u00f3digo Java malicioso, lo que resulta en ejecuci\u00f3n de c\u00f3digo arbitrario en el servidor.\n\nLa explotaci\u00f3n de esta vulnerabilidad requiere una cuenta de usuario v\u00e1lida con privilegios administrativos, lo que limita la superficie de ataque a usuarios autenticados pero potencialmente maliciosos."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FF14774-8935-4FC9-B5C8-9771B3D6EBFD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1"}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063"}, {"criteria": "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7413107-D7B2-49AE-AC46-52E7BFCD6ED8"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}