CVE-2025-5350SSRF and Reflected XSS Vulnerability in Deprecated Try-It Feature of Multiple WSO2 Products
- 5.9MediumCVSS base score
- 0.62%Exploitation in 30 daysEPSS · top 50% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- 1Public exploitsMetasploit, Nuclei and Exploit-DB
Description
SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context. By tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk. Furthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Nuclei template for it.
Show the exploits1
Nuclei templates1 template
- WSO2 - Server Side Request Forgery (Nuclei template) (opens in a new tab)
http/cves/2025/CVE-2025-5350.yamlSeverity medium
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By WSO2
- 5 months later
· 5 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium5.9 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L |
| NVDNVD · Analyzed | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.62% · top 50% of all CVEs (12 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.
Affected products
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.359
- affected 5.11.0 – < 5.11.0.415
- affected 6.0.0 – < 6.0.0.246
- affected 6.1.0 – < 6.1.0.245
- affected 7.0.0 – < 7.0.0.120
- affected 7.1.0 – < 7.1.0.27
WSO2 · WSO2 Enterprise Integrator
- unknown < 6.6.0
- affected 6.6.0 – < 6.6.0.218
- unknown < 3.1.0
- affected 3.1.0 – < 3.1.0.332
- affected 3.2.0 – < 3.2.0.428
- affected 3.2.1 – < 3.2.1.47
- affected 4.0.0 – < 4.0.0.369
- affected 4.1.0 – < 4.1.0.209
- affected 4.2.0 – < 4.2.0.147
- affected 4.3.0 – < 4.3.0.60
- affected 4.4.0 – < 4.4.0.23
- affected 4.5.0 – < 4.5.0.7
- affected 4.5.0 – < 4.5.0.7
- affected 4.5.0 – < 4.5.0.7
- affected 4.5.0 – < 4.5.0.7
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.380
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.401
WSO2 · WSO2 Identity Server as Key Manager
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.352
WSO2 · org.wso2.carbon:org.wso2.carbon.ui
- affected 4.5.3 – < 4.5.3.41
- affected 4.6.0 – < 4.6.0.1087
- affected 4.6.1 – < 4.6.1.151
- affected 4.6.2 – < 4.6.2.672
- affected 4.6.3 – < 4.6.3.30
- affected 4.6.4 – < 4.6.4.7
- affected 4.7.1 – < 4.7.1.70
- affected 4.8.1 – < 4.8.1.32
- affected 4.9.0 – < 4.9.0.101
- affected 4.9.26 – < 4.9.26.19
- affected 4.9.27 – < 4.9.27.3
- affected 4.9.28 – < 4.9.28.1
- affected 4.10.9 – < 4.10.9.69
- affected 4.10.42 – < 4.10.42.11
- unaffected 4.9.29 – ≤ 4.9.*
- unaffected 4.10.93 – ≤ *
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4124/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4124/#solution
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-35829 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-5350)Record last updated .