PT-2025-43609 · Wso2 · Wso2 Products

Noël Maccary · Published 2025-10-24 · Updated 2026-04-13 · CVE-2025-5350

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description The Try-It feature, accessible to administrative users, contains server-side request forgery (SSRF) and reflected cross-site scripting (XSS) issues. The feature does not properly validate user-supplied URLs, allowing SSRF. Retrieved content is directly reflected in the HTTP response, enabling reflected XSS within the admin user's browser. An attacker could trick an administrator into accessing a crafted link, causing the server to fetch malicious content and reflect it into the admin’s browser, potentially leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. SSRF can be used to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable. Session cookies are protected with the HttpOnly flag, but the XSS still presents a security risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

XSS

Weakness Enumeration

CWE-918

CWE-79

Related Identifiers

CVE-2025-5350

Affected Products

Wso2 Products

References · 10

• https://osv.dev/vulnerability/CVE-2025-5350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5350 · Security Note
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4124 · Vendor Advisory
• https://twitter.com/CVEnew/status/1981672230699323853 · Twitter Post
• https://twitter.com/U291cm_9r0v3r/status/2015512192209317949 · Twitter Post
• https://t.me/cveNotify/140145 · Telegram Post
• https://t.me/CVEtracker/35666 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2043600110966501496 · Twitter Post
• https://twitter.com/Souravgro25/status/2014785049464602674 · Twitter Post
• https://t.me/cveNotify/143568 · Telegram Post