CVE-2025-14260: Server Side Request Forgery in Multiple WSO2 Products Allows Access to Internal and External Resources
Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location without enforcing expected validation constraints. This can be exploited by an unauthenticated actor to direct the server to make requests to arbitrary network locations.
Exploiting this vulnerability allows a malicious actor to access both internal and external resources, available through the network or filesystem, that are reachable by the WSO2 product. This could potentially lead to unauthorized access to sensitive data and systems.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account?
The supplied data is inconsistent: the severity vector indicates low privileges are required (PR:L), while the description says exploitation can be performed by an unauthenticated actor. Treat authentication requirements as unconfirmed from this information alone.
What resources could an attacker potentially reach?
An attacker could cause the affected WSO2 server to request internal or external network resources and filesystem-accessible resources, provided they are reachable from that server. Exposure therefore depends on the WSO2 product's network access and filesystem permissions.
Which product versions or configurations are affected?
The supplied information identifies only Multiple WSO2 Products and does not list affected versions, fixed versions, or whether default configurations are vulnerable.