CVE-2025-8154: api control plane from 4.5.0 (inclusive), before 4.5.0.21 (exclusive); +9 more affected products

Affected technology

api control plane · from 4.5.0 (inclusive), before 4.5.0.21 (exclusive)
wso2

api manager · from 4.1.0 (inclusive), before 4.1.0.218 (exclusive)
wso2

api manager · from 4.2.0 (inclusive), before 4.2.0.164 (exclusive)
wso2

api manager · from 4.3.0 (inclusive), before 4.3.0.74 (exclusive)
wso2

api manager · from 4.4.0 (inclusive), before 4.4.0.38 (exclusive)
wso2

api manager · from 4.5.0 (inclusive), before 4.5.0.20 (exclusive)
wso2

traffic manager · from 4.5.0 (inclusive), before 4.5.0.19 (exclusive)
wso2

universal gateway · from 4.5.0 (inclusive), before 4.5.0.19 (exclusive)
wso2

WSO2 API Manager · 4.1.0 to before 4.1.0.218, 4.2.0 to before 4.2.0.164, 4.3.0 to before 4.3.0.74, 4.4.0 to before 4.4.0.38, 4.5.0 to before 4.5.0.20
WSO2

WSO2 Universal Gateway · 4.5.0 to before 4.5.0.19
WSO2

WSO2 Traffic Manager · 4.5.0 to before 4.5.0.19
WSO2

WSO2 API Control Plane · 4.5.0 to before 4.5.0.21
WSO2

WSO2 Carbon API Gateway · 9.20.74 to before 9.20.74.374, 9.28.116 to before 9.28.116.363, 9.29.120 to before 9.29.120.181, 9.30.67 to before 9.30.67.104, 9.31.86 to before 9.31.86.64
WSO2

WSO2 Carbon API Management Implementation · 9.20.74 to before 9.20.74.374, 9.28.116 to before 9.28.116.363, 9.29.120 to before 9.29.120.181, 9.30.67 to before 9.30.67.104, 9.31.86 to before 9.31.86.64
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low. NVD’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality and availability impact as none; integrity impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.