WSO2 API Control Plane Carbon Console injection

Summaryinfo

A vulnerability was found in WSO2 API Control Plane, API Manager, Identity Server, Identity Server as Key Manager, Open Banking AM, Open Banking IAM, Traffic Manager and Universal Gateway. It has been classified as problematic. This affects an unknown function of the component Carbon Console. The manipulation leads to injection. This vulnerability is uniquely identified as CVE-2025-12737. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in WSO2 API Control Plane, API Manager, Identity Server, Identity Server as Key Manager, Open Banking AM, Open Banking IAM, Traffic Manager and Universal Gateway and classified as problematic. This issue affects an unknown code block of the component Carbon Console. The manipulation with an unknown input leads to a injection vulnerability. Using CWE to declare the problem leads to CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative privileges and Carbon Console access to execute remote arbitrary code through specific administrative operations, leading to a complete compromise of the affected system.

The advisory is shared at security.docs.wso2.com. The identification of this vulnerability is CVE-2025-12737 since 11/05/2025. The exploitation is known to be easy. The attack may be initiated remotely. Additional levels of successful authentication are required for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/03/2026). MITRE ATT&CK project uses the attack technique T1055 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Banking Software

Vendor

• WSO2

Name

• API Control Plane
• API Manager
• Identity Server
• Identity Server as Key Manager
• Open Banking AM
• Open Banking IAM
• Traffic Manager
• Universal Gateway

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion