EUVD-2024-55547
GHSA-2xxp-g6g6-xch7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser.
By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag.
AnalysisAI
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag. Affected products include: Wso2 Wso2 Api Manager.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
More in Wso2 Api Manager
View allAuthentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,
Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the
Role-based access control bypass in WSO2 API Manager 3.x allows authenticated users with the 'Internal/Everyone' role to
Reflected cross-site scripting across at least eight WSO2 platform products - including Identity Server, API Manager, AP
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.
Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthentic
WSO2 API Manager and API Control Plane use a non-cryptographic PRNG in the API Publisher component to generate shared se
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today