CVE-2025-7043

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7043", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-07-03T08:50:01.588Z", "datePublished": "2026-10-19T16:28:15.063Z", "dateUpdated": "2026-10-28T20:05:51.992Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-10-19T16:28:15.063Z"}, "title": "Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862: Missing Authentication for Critical Function", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-174", "descriptions": [{"lang": "en", "value": "CAPEC-174 CAPEC-174: Token Replay"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.0", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.434", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.54", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.218", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.156", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.67", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.30", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.14", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.5.0", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.14", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.5.0", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.15", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "Forgerock Key Manager Component", "packageName": "org.wso2.km.ext.forgerock:forgerock.key.manager", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.0.3", "versionType": "custom"}, {"status": "affected", "version": "1.0.0", "lessThan": "1.0.0.4", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.0.2", "versionType": "custom"}, {"status": "affected", "version": "1.1.5", "lessThan": "1.1.5.3", "versionType": "custom"}, {"status": "affected", "version": "1.1.5", "lessThan": "1.1.5.4", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.0", "versionEndExcluding": "3.2.0.434"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.1", "versionEndExcluding": "3.2.1.54"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "4.1.0.218"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2.0", "versionEndExcluding": "4.2.0.156"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "4.3.0.67"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.0", "versionEndExcluding": "4.4.0.30"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5.0", "versionEndExcluding": "4.5.0.14"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5.0", "versionEndExcluding": "4.5.0.14"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.5.0", "versionEndExcluding": "4.5.0.15"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.0.0.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.0.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.1.0", "versionEndExcluding": "1.1.0.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.1.5", "versionEndExcluding": "1.1.5.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.1.5", "versionEndExcluding": "1.1.5.4"}]}]}], "descriptions": [{"lang": "en", "value": "The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2025-4337", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-28T17:47:45.090560Z", "id": "CVE-2025-7043", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T20:05:51.992Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7043", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-28T17:47:45.090560Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T17:47:47.059Z"}}], "cna": {"title": "Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption", "source": {"advisory": "WSO2-2025-4337", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-174", "descriptions": [{"lang": "en", "value": "CAPEC-174 CAPEC-174: Token Replay"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.0", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.434", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.54", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.218", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.156", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.67", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.30", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.14", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.5.0", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.14", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.5.0", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.15", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "Forgerock Key Manager Component", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.0.3", "versionType": "custom"}, {"status": "affected", "version": "1.0.0", "lessThan": "1.0.0.4", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.0.2", "versionType": "custom"}, {"status": "affected", "version": "1.1.5", "lessThan": "1.1.5.3", "versionType": "custom"}, {"status": "affected", "version": "1.1.5", "lessThan": "1.1.5.4", "versionType": "custom"}], "packageName": "org.wso2.km.ext.forgerock:forgerock.key.manager", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.", "supportingMedia": [{"type": "text/html", "value": "The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authentication for Critical Function"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.2.0.434", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.2.1.54", "versionStartIncluding": "3.2.1"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.1.0.218", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.2.0.156", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.3.0.67", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.0.30", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.5.0.14", "versionStartIncluding": "4.5.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.5.0.14", "versionStartIncluding": "4.5.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.5.0.15", "versionStartIncluding": "4.5.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.0.3", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.0.4", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.1.0.2", "versionStartIncluding": "1.1.0"}, {"criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.1.5.3", "versionStartIncluding": "1.1.5"}, {"criteria": "cpe:2.3:a:wso2:forgerock_key_manager_component:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.1.5.4", "versionStartIncluding": "1.1.5"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-10-19T16:28:15.063Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7043", "state": "PUBLISHED", "dateUpdated": "2026-10-28T20:05:51.992Z", "dateReserved": "2025-07-03T08:50:01.588Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-10-19T16:28:15.063Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "3.2.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "3.2.0.434", "status": "affected", "version": "3.2.0", "versionType": "custom"}, {"lessThan": "3.2.1.54", "status": "affected", "version": "3.2.1", "versionType": "custom"}, {"lessThan": "4.1.0.218", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.2.0.156", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.3.0.67", "status": "affected", "version": "4.3.0", "versionType": "custom"}, {"lessThan": "4.4.0.30", "status": "affected", "version": "4.4.0", "versionType": "custom"}, {"lessThan": "4.5.0.14", "status": "affected", "version": "4.5.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Universal Gateway", "vendor": "WSO2", "versions": [{"lessThan": "4.5.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "4.5.0.14", "status": "affected", "version": "4.5.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 API Control Plane", "vendor": "WSO2", "versions": [{"lessThan": "4.5.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "4.5.0.15", "status": "affected", "version": "4.5.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.km.ext.forgerock:forgerock.key.manager", "product": "Forgerock Key Manager Component", "vendor": "WSO2", "versions": [{"lessThan": "1.0.0.3", "status": "affected", "version": "1.0.0", "versionType": "custom"}, {"lessThan": "1.0.0.4", "status": "affected", "version": "1.0.0", "versionType": "custom"}, {"lessThan": "1.1.0.2", "status": "affected", "version": "1.1.0", "versionType": "custom"}, {"lessThan": "1.1.5.3", "status": "affected", "version": "1.1.5", "versionType": "custom"}, {"lessThan": "1.1.5.4", "status": "affected", "version": "1.1.5", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token to obtain a new access token.\n\nAn attacker who obtains a stolen or exposed refresh token can leverage this vulnerability to directly access protected resources. This is possible because the standard security flow requiring client credentials to exchange a refresh token for an access token is circumvented."}, {"lang": "es", "value": "El cliente de ForgeRock no valida correctamente los tokens de actualizaci\u00f3n. Esto permite que un token de actualizaci\u00f3n sea tratado como un token de acceso v\u00e1lido, habilitando su uso para consumir recursos protegidos. Esto produce una elusi\u00f3n del control de seguridad previsto que requiere credenciales de cliente v\u00e1lidas adem\u00e1s de un token de actualizaci\u00f3n para obtener un nuevo token de acceso.\\n\\nUn atacante que obtenga un token de actualizaci\u00f3n robado o expuesto puede aprovechar esta vulnerabilidad para acceder directamente a recursos protegidos. Esto es posible porque se elude el flujo de seguridad est\u00e1ndar que requiere credenciales de cliente para intercambiar un token de actualizaci\u00f3n por un token de acceso."}], "id": "CVE-2025-7043", "lastModified": "2026-11-04T20:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.7, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7043", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-28T17:47:45.090560Z", "version": "2.0.3"}}]}, "published": "2026-10-19T17:16:59.993", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4337/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0,1.0.0.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.0,1.0.0.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.1.0,1.1.0.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.1.5,1.1.5.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.1.5,1.1.5.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Forgerock Key Manager Component", "source": "cna", "vendor": "WSO2"}, "product": "forgerock_key_manager_component", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.5.0,4.5.0.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 API Control Plane", "source": "cna", "vendor": "WSO2"}, "product": "wso2_api_control_plane", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.0,3.2.0.434)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.1,3.2.1.54)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0,4.1.0.218)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0,4.2.0.156)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.3.0,4.3.0.67)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.4.0,4.4.0.30)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.5.0,4.5.0.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 API Manager", "source": "cna", "vendor": "WSO2"}, "product": "wso2_api_manager", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.5.0,4.5.0.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Universal Gateway", "source": "cna", "vendor": "WSO2"}, "product": "wso2_universal_gateway", "vendor": "wso2"}], "created": "2026-10-19T17:30:13.902296+00:00", "updated": "2026-10-19T19:00:04.667027+00:00", "vendors": ["wso2", "wso2$PRODUCT$forgerock_key_manager_component", "wso2$PRODUCT$wso2_api_control_plane", "wso2$PRODUCT$wso2_api_manager", "wso2$PRODUCT$wso2_universal_gateway"]}