An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment.
By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.
References
| Link | Resource |
|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4510/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
04 Dec 2025, 21:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Wso2 api Manager
Wso2 Wso2 enterprise Integrator Wso2 micro Integrator Wso2 traffic Manager Wso2 universal Gateway Wso2 api Control Plane |
|
| References | () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4510/ - Vendor Advisory | |
| CPE | cpe:2.3:a:wso2:micro_integrator:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:micro_integrator:4.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:micro_integrator:4.4.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:micro_integrator:4.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:* cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:micro_integrator:4.3.0:*:*:*:*:*:*:* cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:* |
05 Nov 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-05 19:15
Updated : 2025-12-04 21:09
NVD link : CVE-2025-11093
Mitre link : CVE-2025-11093
CVE.ORG link : CVE-2025-11093
JSON object : View
Products Affected
wso2
- api_control_plane
- api_manager
- micro_integrator
- enterprise_integrator
- universal_gateway
- traffic_manager
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')