Skip to content
OpenAdvisories

Product · WSO2

WSO2 Carbon Command Mediator UI

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2025-13394

    Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

    The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute …

    WSO2 WSO2 API Manager WSO2 Identity Server WSO2 Identity Server as Key Manager