CVE-2025-9955: enterprise integrator 6.0.0, 6.1.0, 6.1.1 (+5 more affected versions); +5 more affected products

Affected technology

enterprise integrator · 6.0.0
wso2

enterprise integrator · 6.1.0
wso2

enterprise integrator · 6.1.1
wso2

enterprise integrator · 6.2.0
wso2

enterprise integrator · 6.3.0
wso2

enterprise integrator · 6.4.0
wso2

enterprise integrator · 6.5.0
wso2

enterprise integrator · 6.6.0
wso2

enterprise service bus · 5.0.0
wso2

WSO2 Enterprise Integrator · 6.0.0 to before 6.0.0.22, 6.1.0 to before 6.1.0.39, 6.1.1 to before 6.1.1.43, 6.2.0 to before 6.2.0.62, 6.3.0 to before 6.3.0.70, 6.4.0 to before 6.4.0.100, 6.5.0 to before 6.5.0.107, 6.6.0 to before 6.6.0.222
WSO2

WSO2 Enterprise Service Bus · 5.0.0 to before 5.0.0.29
WSO2

org.wso2.carbon:org.wso2.carbon.base · 4.4.8 to before 4.4.8.7, 4.4.14 to before 4.4.14.5, 4.4.16 to before 4.4.16.9, 4.4.26 to before 4.4.26.13, 4.4.32 to before 4.4.32.16, 4.4.36 to before 4.4.36.7, 4.4.40 to before 4.4.40.37, 4.5.3 to before 4.5.3.45, 4.9 to before 4.9.29, 4.10 to before 4.10.94
WSO2

org.wso2.carbon:org.wso2.carbon.server.admin · 4.4.8 to before 4.4.8.7, 4.4.14 to before 4.4.14.5, 4.4.16 to before 4.4.16.9, 4.4.26 to before 4.4.26.13, 4.4.32 to before 4.4.32.16, 4.4.36 to before 4.4.36.7, 4.4.40 to before 4.4.40.37, 4.5.3 to before 4.5.3.45, 4.9 to before 4.9.29, 4.10 to before 4.10.94
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Adjacent network · Low privileges required · No user interaction required

What an attacker can do

A low-privileged user can access log data and user-store configuration details that are not intended to be exposed at that privilege level. Source advisory’s CVSS 3.1 assessment (base score 5.7/10) rates confidentiality impact as high; integrity and availability impact as none.