平台
java
组件
wso2-open-banking-am
修复版本
4.5.0.34
4.6.0.1
4.5.0.34
4.6.0.1
4.5.0.36
4.6.0.1
3.1.0.349
3.2.0.453
3.2.1.73
4.0.0.373
4.1.0.236
4.2.0.176
4.3.0.88
4.4.0.52
4.5.0.35
4.6.0.1
5.10.0.378
5.11.0.425
6.0.0.252
6.1.0.253
7.0.0.130
7.1.0.38
7.2.0.1
5.10.0.369
6.6.0.226
4.5.3.50
4.6.0.2253
4.6.1.157
4.6.2.673
4.6.3.41
4.6.4.22
4.7.1.73
4.8.1.43
4.9.0.106
4.9.26.31
4.9.27.16
4.9.28.18
4.9.33.2
4.10.9.75
4.10.42.18
4.10.101.3
CVE-2025-6670 describes a Cross-Site Request Forgery (CSRF) vulnerability found in WSO2 Open Banking AM. This vulnerability allows an attacker to potentially manipulate an authenticated user's session and perform unauthorized actions within the admin services. The issue stems from the use of HTTP GET requests for state-changing operations, bypassing the effectiveness of the SameSite cookie attribute. Affected versions include those prior to 7.2.0.1, and a fix is available in version 7.2.0.1.
An attacker can exploit this CSRF vulnerability by crafting a malicious link and enticing an authenticated user to click it. Upon clicking, the user's browser will unknowingly send a request to the WSO2 Open Banking AM server, executing the attacker's intended action. This could involve modifying configurations, creating or deleting users, or performing other administrative tasks without the user's explicit consent. The potential impact is significant, as a successful exploit could lead to unauthorized access and control over the WSO2 Open Banking AM instance, potentially compromising sensitive data and disrupting services. The reliance on GET requests for state changes, despite the presence of SameSite cookies, is the root cause, making this a particularly concerning vulnerability.
CVE-2025-6670 was publicly disclosed on 2025-11-18. The vulnerability's reliance on GET requests for state changes, while employing SameSite cookies, presents a unique exploitation challenge. Currently, there are no publicly available proof-of-concept exploits, but the vulnerability's ease of exploitation makes it a potential target for opportunistic attackers. It is not currently listed on the CISA KEV catalog. The CVSS score of 8.8 (HIGH) reflects the potential for significant impact.
Organizations utilizing WSO2 Open Banking AM in production environments, particularly those with legacy configurations or shared hosting environments, are at risk. Environments where admin access is not adequately restricted or monitored are especially vulnerable. Any deployment relying on older, unpatched versions of WSO2 Open Banking AM is potentially exposed.
• linux / server: Monitor WSO2 Open Banking AM access logs for unusual GET requests to admin endpoints. Use journalctl to filter for errors related to authentication or authorization.
journalctl -u wso2am -f | grep "CSRF" • generic web: Use curl to test for CSRF vulnerabilities on admin endpoints. Check response headers for unexpected behavior after submitting a request.
curl -v -X GET 'https://wso2am/admin/endpoint?param=value' -b 'Cookie: SESSIONID=...' • java: Examine WSO2 Open Banking AM code for instances where GET requests are used for state-changing operations. Look for patterns where user input is directly used in the request without proper validation.
disclosure
漏洞利用状态
EPSS
0.04% (10% 百分位)
CISA SSVC
CVSS 向量
The primary mitigation for CVE-2025-6670 is to upgrade WSO2 Open Banking AM to version 7.2.0.1 or later, which includes the fix for this vulnerability. If an immediate upgrade is not feasible, consider implementing temporary workarounds to reduce the attack surface. These may include restricting access to admin services to trusted networks, implementing stricter input validation on all admin endpoints, and carefully reviewing any third-party integrations that interact with the admin console. While SameSite cookies are present, their ineffectiveness in this scenario highlights the importance of using POST requests for state-changing operations. After upgrading, confirm the fix by attempting to trigger a CSRF attack and verifying that the request is blocked or ignored.
升级到包含 CSRF 漏洞修复程序的最新版本的 WSO2 Open Banking AM。 确保 Carbon 控制台服务未暴露给不可信的网络，遵循 WSO2 安全生产指南。
漏洞分析和关键警报直接发送到您的邮箱。
CVE-2025-6670 is a Cross-Site Request Forgery (CSRF) vulnerability in WSO2 Open Banking AM versions prior to 7.2.0.1, allowing attackers to perform unauthorized actions via crafted links.
Yes, if you are running WSO2 Open Banking AM versions earlier than 7.2.0.1, you are potentially affected by this CSRF vulnerability.
Upgrade WSO2 Open Banking AM to version 7.2.0.1 or later to resolve the vulnerability. Consider temporary workarounds if immediate upgrade is not possible.
While no public exploits are currently known, the vulnerability's ease of exploitation makes it a potential target for attackers.
Refer to the official WSO2 security advisory for detailed information and updates regarding CVE-2025-6670: [https://wso2.com/en/security/vulnerabilities/cve-2025-6670/](https://wso2.com/en/security/vulnerabilities/cve-2025-6670/)
上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。
上传你的 pom.xml 文件，立即知道是否受影响。