Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher (WSO2 WSO2 API Manager)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.19 % · percentile 8 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
- NVD status
- Analyzed
Description
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | WSO2 |
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
Advisories
- GHSA-cmjc-qp7j-xgwr — WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability
European references
- ENISA EUVD · EUVD-2025-30893
- GCVE · GCVE-0-2025-4760
Affected configurations (NVD CPE)
cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 API Manager | unknown 0 < 3.2.0 ; affected 3.2.0 < 3.2.0.428 ; affected 3.2.1 < 3.2.1.48 ; affected 4.1.0 < 4.1.0.209 ; affected 4.2.0 < 4.2.0.145 ; affected 4.3.0 < 4.3.0.60 |
| WSO2 · WSO2 API Control Plane | affected 4.5.0 < 4.5.0.8 |
| WSO2 · WSO2 Universal Gateway | affected 4.5.0 < 4.5.0.7 |
| WSO2 · WSO2 Traffic Manager | affected 4.5.0 < 4.5.0.7 |
| WSO2 · WSO2 Carbon API Management API | affected 6.7.206 < 6.7.206.559 ; affected 6.7.210 < 6.7.210.48 ; affected 9.20.74 < 9.20.74.365 ; affected 9.28.116 < 9.28.116.321 ; affected 9.29.120 < 9.29.120.163 ; affected 9.30.67 < 9.30.67.80 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |