cveboard RSS feed

CVE-2025-11093

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2025
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 Micro Integrator

Vendor
WSO2
Product
WSO2 Micro Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Micro Integrator · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom4.0.0UnavailableNone listed
4.0.0affectedcustom4.0.0.145UnavailableNone listed
4.1.0affectedcustom4.1.0.147UnavailableNone listed
4.2.0affectedcustom4.2.0.141UnavailableNone listed
4.3.0affectedcustom4.3.0.42UnavailableNone listed
4.4.0affectedcustom4.4.0.27UnavailableNone listed

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.1.0UnavailableNone listed
3.1.0affectedcustom3.1.0.345UnavailableNone listed
3.2.0affectedcustom3.2.0.446UnavailableNone listed
3.2.1affectedcustom3.2.1.66UnavailableNone listed
4.0.0affectedcustom4.0.0.366UnavailableNone listed
4.1.0affectedcustom4.1.0.228UnavailableNone listed
4.2.0affectedcustom4.2.0.169UnavailableNone listed
4.3.0affectedcustom4.3.0.81UnavailableNone listed
4.4.0affectedcustom4.4.0.45UnavailableNone listed
4.5.0affectedcustom4.5.0.28UnavailableNone listed

WSO2 Enterprise Integrator

Vendor
WSO2
Product
WSO2 Enterprise Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Integrator · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom6.6.0UnavailableNone listed
6.6.0affectedcustom6.6.0.224UnavailableNone listed

WSO2 Universal Gateway

Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.27UnavailableNone listed

WSO2 API Control Plane

Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.29UnavailableNone listed

WSO2 Traffic Manager

Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
4.5.0affectedcustom4.5.0.27UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.414UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.394UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.365UnavailableNone listed

org.apache.synapse:synapse-core

Vendor
WSO2
Product
org.apache.synapse:synapse-core
Platforms
Unknown
Default status
unknown
Package
org.apache.synapse:synapse-core
org.apache.synapse:synapse-core · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.1.7.wso2v227affectedcustom2.1.7.wso2v227_99UnavailableNone listed
2.1.7.wso2v271affectedcustom2.1.7.wso2v271_88UnavailableNone listed
2.1.7.wso2v143affectedcustom2.1.7.wso2v143_121UnavailableNone listed
2.1.7.wso2v319affectedcustom2.1.7.wso2v319_13UnavailableNone listed
2.1.7.wso2v183affectedcustom2.1.7.wso2v183_72UnavailableNone listed
4.0.0.wso2v119affectedcustom4.0.0.wso2v119_27UnavailableNone listed
4.0.0.wso2v20affectedcustom4.0.0.wso2v20_93UnavailableNone listed
4.0.0.wso2v215affectedcustom4.0.0.wso2v215_26UnavailableNone listed
4.0.0.wso2v218affectedcustom4.0.0.wso2v218_1UnavailableNone listed
4.0.0.wso2v105affectedcustom4.0.0.wso2v105_13UnavailableNone listed
4.0.0.wso2v131affectedcustom4.0.0.wso2v131_5UnavailableNone listed
4.0.0-wso2v254unaffectedcustomUnavailable*None listed

org.apache.synapse:synapse-extensions

Vendor
WSO2
Product
org.apache.synapse:synapse-extensions
Platforms
Unknown
Default status
unknown
Package
org.apache.synapse:synapse-extensions
org.apache.synapse:synapse-extensions · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
2.1.7.wso2v227affectedcustom2.1.7.wso2v227_99UnavailableNone listed
2.1.7.wso2v271affectedcustom2.1.7.wso2v271_88UnavailableNone listed
2.1.7.wso2v143affectedcustom2.1.7.wso2v143_121UnavailableNone listed
2.1.7.wso2v319affectedcustom2.1.7.wso2v319_13UnavailableNone listed
2.1.7.wso2v183affectedcustom2.1.7.wso2v183_72UnavailableNone listed
4.0.0.wso2v119affectedcustom4.0.0.wso2v119_27UnavailableNone listed
4.0.0.wso2v20affectedcustom4.0.0.wso2v20_93UnavailableNone listed
4.0.0.wso2v215affectedcustom4.0.0.wso2v215_26UnavailableNone listed
4.0.0.wso2v218affectedcustom4.0.0.wso2v218_1UnavailableNone listed
4.0.0.wso2v105affectedcustom4.0.0.wso2v105_13UnavailableNone listed
4.0.0.wso2v131affectedcustom4.0.0.wso2v131_5UnavailableNone listed
4.0.0-wso2v254unaffectedcustomUnavailable*None listed