CVE-2025-7203: WSO2 Universal Gateway 4.5.0 to before 4.5.0.46, 4.6.0 to before 4.6.0.14; +7 more affected products

Affected technology

WSO2 Universal Gateway · 4.5.0 to before 4.5.0.46, 4.6.0 to before 4.6.0.14
WSO2

WSO2 Traffic Manager · 4.5.0 to before 4.5.0.45, 4.6.0 to before 4.6.0.14
WSO2

WSO2 API Control Plane · 4.5.0 to before 4.5.0.47, 4.6.0 to before 4.6.0.15
WSO2

WSO2 API Manager · 4.3.0 to before 4.3.0.97, 4.4.0 to before 4.4.0.61, 4.5.0 to before 4.5.0.46, 4.6.0 to before 4.6.0.14
WSO2

WSO2 Identity Server · 7.0.0 to before 7.0.0.111, 7.1.0 to before 7.1.0.19
WSO2

WSO2 Carbon Secured HTTP Log4j2 Appender · 4.9.11 to before 4.9.11.4, 4.9.18 to before 4.9.18.2, 4.10.9 to before 4.10.9.2, 4.10.19 to before 4.10.19.1
WSO2

WSO2 Carbon Logging Services · 4.9.11 to before 4.9.11.4, 4.9.18 to before 4.9.18.2, 4.10.9 to before 4.10.9.2, 4.10.19 to before 4.10.19.1
WSO2

WSO2 Carbon Identity API Server Configs V1 · 1.2.176 to before 1.2.176.16, 1.3.83 to before 1.3.83.7
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 4.9/10) rates confidentiality impact as high; integrity and availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.