Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Solution
Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4119/#solution
Workaround
No workaround given by the vendor.
Tue, 23 Sep 2025 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 23 Sep 2025 16:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service. A user with administrative access to the SOAP admin services can exploit this flaw by deploying a Siddhi execution plan containing malicious Java code, resulting in arbitrary code execution on the server. Exploitation of this vulnerability requires a valid user account with administrative privileges, limiting the attack surface to authenticated but potentially malicious users. | |
| Title | Authenticated Remote Code Execution in Multiple WSO2 Products via Event Processor Admin Service | |
| Weaknesses | CWE-94 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: WSO2
Published:
Updated: 2025-09-23T18:37:55.308Z
Reserved: 2025-06-05T06:06:53.039Z
Link: CVE-2025-5717
Vulnrichment
Updated: 2025-09-23T18:31:31.819Z
NVD
Status : Received
Published: 2025-09-23T16:15:33.620
Modified: 2025-09-23T16:15:33.620
Link: CVE-2025-5717
Redhat
No data.
OpenCVE Enrichment
No data.