by Kastro
Paper/Archive/CVE-2025-9152

CVE-2025-9152

WSO2 WSO2 API Manager — Improper Privilege Management in Multiple WSO2 API Manager via keymanager-operations DCR Endpoint

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 53.6.536 × 2010.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An improper privilege management vulnerability exists in WSO2 API Manager due to missing authentication and authorization checks in the keymanager-operations Dynamic Client Registration (DCR) endpoint. A malicious user can exploit this flaw to generate access tokens with elevated privileges, potentially leading to administrative access and the ability to perform unauthorized operations.

Affected

ProductAffectedFixed inSource
WSO2 API Manager3.2.0 – < 3.2.0.4373.2.0.437CNA
WSO2 API Manager3.2.1 – < 3.2.1.573.2.1.57CNA
WSO2 API Manager4.0.0 – < 4.0.0.3574.0.0.357CNA
WSO2 API Manager4.1.0 – < 4.1.0.2214.1.0.221CNA
WSO2 API Manager4.2.0 – < 4.2.0.1594.2.0.159CNA
WSO2 API Manager4.3.0 – < 4.3.0.724.3.0.72CNA
WSO2 API Manager4.4.0 – < 4.4.0.354.4.0.35CNA
WSO2 API Manager4.5.0 – < 4.5.0.194.5.0.19CNA
WSO2 API Control Plane4.5.0 – < 4.5.0.204.5.0.20CNA

Scores by source

WSO2 (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysecurity.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4483