CVE-2025-9152
Full vulnerability record from the local CVENow database.
Description
An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Analyzed
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2025-10-16 13:15:41.840000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-9152",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2025-10-16T13:15:41.840",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint.\n\nA malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de gestión de privilegios inadecuada en WSO2 API Manager debido a la falta de comprobaciones de autenticación y autorización en el endpoint de Registro Dinámico de Clientes (DCR) de keymanager-operations.\n\nUn usuario malintencionado puede explotar esta falla para generar tokens de acceso con privilegios elevados, lo que podría conducir a acceso administrativo y la capacidad de realizar operaciones no autorizadas."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "3.2.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "3.2.0",
"lessThan": "3.2.0.437",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.1",
"lessThan": "3.2.1.57",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0",
"lessThan": "4.0.0.357",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.0.221",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.159",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.72",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.0",
"lessThan": "4.4.0.35",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.5.0",
"lessThan": "4.5.0.19",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 API Control Plane",
"defaultStatus": "unaffected",
"versions": [
{
"version": "4.5.0",
"lessThan": "4.5.0.20",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-16T12:59:14.709557Z",
"id": "CVE-2025-9152",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
"matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
"matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1"
}
]
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4483/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"tags": [
"Vendor Advisory"
]
}
]
}