CVE-2025-8325: api control plane from 4.5.0 (inclusive), before 4.5.0.18 (exclusive); +9 more affected products

Affected technology

api control plane · from 4.5.0 (inclusive), before 4.5.0.18 (exclusive)
wso2

api manager · from 3.2.0 (inclusive), before 3.2.0.435 (exclusive)
wso2

api manager · from 3.2.1 (inclusive), before 3.2.1.55 (exclusive)
wso2

api manager · from 4.0.0 (inclusive), before 4.0.0.355 (exclusive)
wso2

api manager · from 4.1.0 (inclusive), before 4.1.0.219 (exclusive)
wso2

api manager · from 4.2.0 (inclusive), before 4.2.0.157 (exclusive)
wso2

api manager · from 4.3.0 (inclusive), before 4.3.0.70 (exclusive)
wso2

api manager · from 4.4.0 (inclusive), before 4.4.0.33 (exclusive)
wso2

api manager · from 4.5.0 (inclusive), before 4.5.0.17 (exclusive)
wso2

traffic manager · from 4.5.0 (inclusive), before 4.5.0.17 (exclusive)
wso2

universal gateway · from 4.5.0 (inclusive), before 4.5.0.17 (exclusive)
wso2

WSO2 API Control Plane · 4.5.0 to before 4.5.0.18
WSO2

WSO2 Universal Gateway · 4.5.0 to before 4.5.0.17
WSO2

WSO2 Traffic Manager · 4.5.0 to before 4.5.0.17
WSO2

WSO2 API Manager · 3.2.0 to before 3.2.0.435, 3.2.1 to before 3.2.1.55, 4.0.0 to before 4.0.0.355, 4.1.0 to before 4.1.0.219, 4.2.0 to before 4.2.0.157, 4.3.0 to before 4.3.0.70, 4.4.0 to before 4.4.0.33, 4.5.0 to before 4.5.0.17
WSO2

WSO2 Carbon API Management Implementation · 6.7.206 to before 6.7.206.563, 6.7.210 to before 6.7.210.55, 9.0.174 to before 9.0.174.513, 9.20.74 to before 9.20.74.375, 9.28.116 to before 9.28.116.352, 9.29.120 to before 9.29.120.177, 9.30.67 to before 9.30.67.100, 9.31.86 to before 9.31.86.58
WSO2

WSO2 Carbon API Manager Rest API Utility · 6.7.206 to before 6.7.206.563, 6.7.210 to before 6.7.210.55, 9.0.174 to before 9.0.174.513, 9.20.74 to before 9.20.74.375, 9.28.116 to before 9.28.116.352, 9.29.120 to before 9.29.120.177, 9.30.67 to before 9.30.67.100, 9.31.86 to before 9.31.86.58
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. Source advisory’s CVSS 3.1 assessment (base score 6.3/10) rates confidentiality, integrity and availability impact as low. NVD’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.