CVE-2024-8008

MediumCVSS 5.2/10Last modified Oct 16, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.

This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

Metrics

CVSS 3.1 5.2/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2025
Last modified: Oct 16, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-80094.3The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page CVE-2024-80107.5The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a CVE-2024-80115.5Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions grante CVE-2024-80127.8An authentication bypass weakness in the message broker service of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local CVE-2024-80133.3A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted f CVE-2024-80148.8In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an i CVE-2024-80157.2In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injecti CVE-2024-80167.2The Events Calendar Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.0.2 via deseriali CVE-2024-80179.0An XSS vulnerability exists in open-webui/open-webui versions <= 0.3.8, specifically in the function that constructs the HTML for tooltips. CVE-2024-80187.5A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack. When uploading a file, if an attacker app CVE-2024-80199.1In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the `LightningApp` when running on a Windows host. The vulnerabil CVE-2024-80207.5A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POS