CVE-2025-13475: api manager from 3.2.0 (inclusive), before 3.2.0.457 (exclusive), from 3.2.1 (inclusive), before 3.2.1.76 (exclusive)…

Affected technology

api manager · from 3.2.0 (inclusive), before 3.2.0.457 (exclusive)
wso2

api manager · from 3.2.1 (inclusive), before 3.2.1.76 (exclusive)
wso2

identity server · from 5.10.0 (inclusive), before 5.10.0.382 (exclusive)
wso2

WSO2 Identity Server · 5.10.0 to before 5.10.0.382
WSO2

WSO2 API Manager · 3.2.0 to before 3.2.0.457, 3.2.1 to before 3.2.1.76
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 3.5/10) rates confidentiality impact as low; integrity and availability impact as none. NVD’s CVSS 3.1 assessment (base score 7.3/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.