WSO2多產品受CVE-2025-14260 SSRF漏洞影響，內外部資源易被未授權存取
CVE-2025-14260 - Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
CVE-2025-14260 是一個 SSRF 漏洞，已影響多個 WSO2 產品，允許未授權使用者讓伺服器向任意網路位置傳送請求。
- 漏洞型別：Server Side Request Forgery (SSRF)。
此漏洞揭示WSO2多產品缺失的資源位置驗證，提醒開發者即時更新以避免內部資源外洩，並強調驗證機制的重要性。未修補的系統可能被未授權使用者利用進行內網探測或外部資料竊取，甚至導致機密資訊洩漏。
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations. Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
Impact
Affected Products
The following products are affected by CVE-2025-14260
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
| ID | Vendor | Product | Action |
|---|---|---|---|
| 1 | Wso2 | api_manager | |
| 2 | Wso2 | identity_server | |
| 3 | Wso2 | identity_server_as_key_manager | |
| 4 | Wso2 | open_banking_am | |
| 5 | Wso2 | open_banking_iam | |
| 6 | Wso2 | wso2_open_banking_am | |
| 7 | Wso2 | wso2_identity_server | |
| 8 | Wso2 | wso2_open_banking_iam | |
| 9 | Wso2 | wso2_api_manager | |
| 10 | Wso2 | wso2_identity_server_as_key_manager | |
| 11 | Wso2 | saml2_sso_authenticator_ui_bundle | |
| 12 | Wso2 | wso2_carbon_ui |
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | ed10eef1-636d-4fbe-9993-6890dfa878f8 | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Implement proper access control validation for resource location inputs to prevent unauthorized server requests.
- Validate user-supplied resource location inputs.
- Enforce expected validation constraints.
- Restrict access to authorized locations.
- Apply vendor-recommended security updates.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-14260 vulnerability anywhere in the article.
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.