CVE-2025-9955
Full vulnerability record from the local CVENow database.
Description
An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. While no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance.
Severity
MEDIUM
CVSS score
5.7
(v3.1)
Vulnerability status
Analyzed
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2025-10-16 13:15:42.300000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-9955",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2025-10-16T13:15:42.300",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to system logs and user-store configuration. A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level.\n\nWhile no credentials or sensitive user information are exposed, this vulnerability may allow unauthorized visibility into internal operational details, which could aid in further exploitation or reconnaissance."
},
{
"lang": "es",
"value": "Una vulnerabilidad de control de acceso inadecuado existe en el producto WSO2 Enterprise Integrator debido a restricciones de permisos insuficientes en los servicios de administración SOAP internos relacionados con los registros del sistema y la configuración del almacén de usuarios. Un usuario de bajo privilegio puede acceder a datos de registro y detalles de configuración del almacén de usuarios que no están destinados a ser expuestos a ese nivel de privilegio.\n\nSi bien no se exponen credenciales ni información sensible del usuario, esta vulnerabilidad puede permitir una visibilidad no autorizada de detalles operativos internos, lo que podría ayudar en una explotación o reconocimiento posterior."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 Enterprise Integrator",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "6.0.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "6.0.0",
"lessThan": "6.0.0.22",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.1.0",
"lessThan": "6.1.0.39",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.1.1",
"lessThan": "6.1.1.43",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.2.0",
"lessThan": "6.2.0.62",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.3.0",
"lessThan": "6.3.0.70",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.4.0",
"lessThan": "6.4.0.100",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.5.0",
"lessThan": "6.5.0.107",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.6.0",
"lessThan": "6.6.0.222",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Enterprise Service Bus",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "5.0.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "5.0.0",
"lessThan": "5.0.0.29",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "org.wso2.carbon:org.wso2.carbon.base",
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.base",
"versions": [
{
"version": "4.4.8",
"lessThan": "4.4.8.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.14",
"lessThan": "4.4.14.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.16",
"lessThan": "4.4.16.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.26",
"lessThan": "4.4.26.13",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.32",
"lessThan": "4.4.32.16",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.36",
"lessThan": "4.4.36.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.40",
"lessThan": "4.4.40.37",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.5.3",
"lessThan": "4.5.3.45",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.9",
"lessThan": "4.9.29",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.10",
"lessThan": "4.10.94",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "org.wso2.carbon:org.wso2.carbon.server.admin",
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon:org.wso2.carbon.server.admin",
"versions": [
{
"version": "4.4.8",
"lessThan": "4.4.8.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.14",
"lessThan": "4.4.14.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.16",
"lessThan": "4.4.16.9",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.26",
"lessThan": "4.4.26.13",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.32",
"lessThan": "4.4.32.16",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.36",
"lessThan": "4.4.36.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.40",
"lessThan": "4.4.40.37",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.5.3",
"lessThan": "4.5.3.45",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.9",
"lessThan": "4.9.29",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.10",
"lessThan": "4.10.94",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-10-16T13:23:25.309685Z",
"id": "CVE-2025-9955",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2242AF12-0C75-41A7-8450-B9A2EBF5A8CE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D64106E7-1956-4AAA-915F-7E6DB7461BD4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EA3B48BB-ECB5-4A94-B76D-97BC3D303E9E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "66292C25-B0B9-4FCE-9382-57B8F6BB814A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "709DC7EA-18A6-4B83-84CB-F2499BEB5D2F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "18E8577A-B322-4A70-B8AB-9DE45EFDF229"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "4FCA89E3-F37E-494E-AD46-B9A04E608908"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:enterprise_service_bus:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "236C44E3-FAB5-41F2-9884-D17944EBB468"
}
]
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4526/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"tags": [
"Vendor Advisory"
]
}
]
}