WaratekVRT Sign in

CVE-2025-13394

Affected software4 products, listed below
Severity5.4 Medium CVSS 3.1
WeaknessCross-site request forgery (CWE-352)
Published6 Aug 2026
Updated29 Sep 2026

Description

The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines.

Exploitation status

No public exploit

No exploit has been reported in the sources we check.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 0.14% chance in 30 days

Waratek protection

No exploit published

Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.

VRT has not found a public code change for this CVE yet.

  • Protection none
  • Action not pursued
  • Review automated Upstream data
  • Record active
Decided by Nothing to build a rule from yet: no published exploit, no CISA record of exploitation and no source-level change to read
Finding This CVE affects a known product, but nothing published names a fix and nothing published shows an exploit. That is a statement about the evidence, not about the defect — it does not mean the vulnerability is unimportant or unreachable, only that neither of the two things VRT can act on exists.

Affected software and releases

Products and versions

9 products, 27 version entries
SourceVendorProductSchemeAffected versions
nvd wso2 api control plane generic ≥ 4.5.0 and ＜ 4.5.0.39 · ≥ 4.6.0 and ＜ 4.6.0.3
nvd wso2 api manager generic ≥ 3.1.0 and ＜ 3.1.0.352 · ≥ 3.2.0 and ＜ 3.2.0.456 · ≥ 3.2.1 and ＜ 3.2.1.75 · ≥ 4.0.0 and ＜ 4.0.0.376 · ≥ 4.1.0 and ＜ 4.1.0.239 · ≥ 4.2.0 and ＜ 4.2.0.179 · ≥ 4.3.0 and ＜ 4.3.0.91 · ≥ 4.4.0 and ＜ 4.4.0.55 · ≥ 4.5.0 and ＜ 4.5.0.38 · ≥ 4.6.0 and ＜ 4.6.0.3
nvd wso2 enterprise integrator generic ≥ 6.6.0 and ＜ 6.6.0.227
nvd wso2 identity server generic ≥ 5.10.0 and ＜ 5.10.0.381 · ≥ 5.11.0 and ＜ 5.11.0.428 · ≥ 6.0.0 and ＜ 6.0.0.255 · ≥ 6.1.0 and ＜ 6.1.0.256 · ≥ 7.0.0 and ＜ 7.0.0.133 · ≥ 7.1.0 and ＜ 7.1.0.41 · ≥ 7.2.0 and ＜ 7.2.0.3
nvd wso2 identity server as key manager generic ≥ 5.10.0 and ＜ 5.10.0.372
nvd wso2 open banking am generic ≥ 2.0.0 and ＜ 2.0.0.401
nvd wso2 open banking iam generic ≥ 2.0.0 and ＜ 2.0.0.421
nvd wso2 traffic manager generic ≥ 4.5.0 and ＜ 4.5.0.37 · ≥ 4.6.0 and ＜ 4.6.0.3
nvd wso2 universal gateway generic ≥ 4.5.0 and ＜ 4.5.0.37 · ≥ 4.6.0 and ＜ 4.6.0.3

References

URLTags
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4800/ Vendor Advisory

Timeline
Published2026-08-06By the CVE Program.
NVD record modified2026-09-29NVD's own last-modified date for this record.