CVE-2025-5717: Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service
An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server.
Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5717?
CVE-2025-5717 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2025-5717?
To mitigate CVE-2025-5717, ensure you update your WSO2 products to the latest patched versions that address this vulnerability.
Who can exploit CVE-2025-5717?
CVE-2025-5717 can be exploited by authenticated users with administrative access to the SOAP admin services in affected WSO2 products.
What are the potential impacts of CVE-2025-5717?
The exploitation of CVE-2025-5717 could allow attackers to execute arbitrary code on the server, leading to unauthorized access and data compromise.
Which WSO2 products are affected by CVE-2025-5717?
CVE-2025-5717 affects multiple WSO2 products that utilize the event processor admin service.