CVE-2025-1862: enterprise integrator 6.6.0; +7 more affected products

Affected technology

enterprise integrator · 6.6.0
wso2

identity server · 5.10.0
wso2

identity server · 5.11.0
wso2

identity server · 6.0.0
wso2

identity server · 6.1.0
wso2

identity server as key manager · 5.10.0
wso2

open banking iam · 2.0.0
wso2

WSO2 Enterprise Integrator · 6.6.0 to before 6.6.0.215
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.347, 5.11.0 to before 5.11.0.396, 6.0.0 to before 6.0.0.232, 6.1.0 to before 6.1.0.224
WSO2

WSO2 Open Banking IAM · 2.0.0 to before 2.0.0.391
WSO2

WSO2 Identity Server as Key Manager · 5.10.0 to before 5.10.0.340
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

An attacker can upload a specially crafted payload and achieve remote code execution (RCE), potentially compromising the server and its data. Source advisory’s CVSS 3.1 assessment (base score 6.7/10) rates confidentiality and integrity impact as high; availability impact as low. NVD’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high.