CVE-2025-5717
Full vulnerability record from the local CVENow database.
Description
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
Severity
HIGH
CVSS score
7.2
(v3.1)
Vulnerability status
Analyzed
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2025-09-23 16:15:33.620000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-5717",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2025-09-23T16:15:33.620",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.\n\nExploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de ejecución remota de código (RCE) autenticada en múltiples productos WSO2 debido a una validación de entrada incorrecta en el servicio de administración del procesador de eventos. Un usuario con acceso administrativo a los servicios de administración SOAP puede explotar esta falla mediante el despliegue de un plan de ejecución Siddhi que contenga código Java malicioso, lo que resulta en ejecución de código arbitrario en el servidor.\n\nLa explotación de esta vulnerabilidad requiere una cuenta de usuario válida con privilegios administrativos, lo que limita la superficie de ataque a usuarios autenticados pero potencialmente maliciosos."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "3.0.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "3.0.0",
"lessThan": "3.0.0.174",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.1.0",
"lessThan": "3.1.0.330",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.0",
"lessThan": "3.2.0.426",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.1",
"lessThan": "3.2.1.46",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0",
"lessThan": "4.0.0.344",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.0.208",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.147",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.59",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.0",
"lessThan": "4.4.0.22",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.5.0",
"lessThan": "4.5.0.6",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Open Banking AM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "2.0.0",
"lessThan": "2.0.0.379",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Traffic Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.5.0",
"lessThan": "4.5.0.6",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 API Control Plane",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.5.0",
"lessThan": "4.5.0.6",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "Siddhi Extension Evaluate Scripts",
"defaultStatus": "unknown",
"packageName": "org.wso2.siddhi:siddhi-extension-eval-scriptApache",
"versions": [
{
"version": "3.2.6",
"lessThan": "3.2.6.8",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.7",
"lessThan": "3.2.7.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.8",
"lessThan": "3.2.8.3",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.10",
"lessThan": "3.2.10.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.13",
"lessThan": "3.2.13.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.14",
"lessThan": "3.2.14.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.15",
"lessThanOrEqual": "*",
"versionType": "custom",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.9,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-23T18:31:28.992929Z",
"id": "CVE-2025-5717",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8FF14774-8935-4FC9-B5C8-9771B3D6EBFD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
"matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
"matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C7413107-D7B2-49AE-AC46-52E7BFCD6ED8"
}
]
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"tags": [
"Vendor Advisory"
]
}
]
}