Description
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
Metrics
CVSS 3.1 4.8/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | >= 3.2.0, < 3.2.0.428; >= 3.2.1, < 3.2.1.48; >= 4.1.0, < 4.1.0.209; >= 4.2.0, < 4.2.0.145; >= 4.3.0, < 4.3.0.60; >= 4.4.0, < 4.4.0.23; >= 4.5.0, < 4.5.0.7 |
| WSO2 | WSO2 API Control Plane | >= 4.5.0, < 4.5.0.8 |
| WSO2 | WSO2 Universal Gateway | >= 4.5.0, < 4.5.0.7 |
| WSO2 | WSO2 Traffic Manager | >= 4.5.0, < 4.5.0.7 |
| WSO2 | WSO2 Carbon API Management API | >= 6.7.206, < 6.7.206.559; >= 6.7.210, < 6.7.210.48; >= 9.20.74, < 9.20.74.365; >= 9.28.116, < 9.28.116.321; >= 9.29.120, < 9.29.120.163; >= 9.30.67, < 9.30.67.80; >= 9.31.86, < 9.31.86.30 |
References
Timeline
- Published
- Sep 23, 2025
- Last modified
- Oct 18, 2026
- NVD status
- Analyzed