Threats tagged 'ghsa-8rr2-f52p-r9q3'

CVE-2025-13394 is a Cross-Site Request Forgery (CSRF) vulnerability in the Ajax processor of the Carbon console within WSO2 Identity Server. The vulnerability arises because state-changing operations use the HTTP GET method and rely on the SameSite=Lax cookie attribute for CSRF mitigation, which can be bypassed. This allows attackers to trick authenticated users into unknowingly performing unauthorized actions. Exploitation requires the Carbon console and related services to be publicly accessible, which is against WSO2's security recommendations.