The Ajax processor in the Carbon console of WSO2 Identity Server versions 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, 7.1.0, and 7.2.0 fails to adequately protect state-changing operations from CSRF attacks. It uses HTTP GET for these operations and relies on the SameSite=Lax cookie attribute, which allows cookies to be sent with cross-origin top-level navigation GET requests, enabling attackers to bypass this protection. This can lead to unauthorized state changes such as data modification or account changes if the vulnerable service is exposed to the public internet.

An attacker can perform unauthorized state-altering requests on behalf of authenticated users, potentially leading to data modification, account changes, or loss of user control. However, exploitation is limited to scenarios where the Carbon console and related services are publicly accessible, which is not recommended by the vendor.

No official patch or remediation level has been published by WSO2 for this vulnerability. Since the vulnerability requires public exposure of the Carbon console, following WSO2's security guidelines to avoid exposing these services to the public internet is the primary mitigation. Monitor the vendor advisory for any future patches or updates.