Skip to main content

Wso2 Api Manager CVE-2025-6024

| EUVDEUVD-2025-209497 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-04-16 WSO2 GHSA-ppc7-gg9m-7hwq
XSS Wso2 Api Manager Wso2 Identity Server Wso2
6.1
CVSS 3.1 · Vendor: WSO2
View

Vulnerability Assessment

Weakness
CWE
CWE-79
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 27, 2026

Reflected cross-site scripting in the authentication endpoint of WSO2 API Manager and Identity Server allows unauthenticated attackers to inject arbitrary web scripts. Affected versions include API Manager 3.1.0 to 4.1.0 and Identity Server 5.10.0 to 5.11.0. While exploitation requires user interaction, successful attacks can result in information disclosure or UI manipulation; EPSS indicates very low exploitation likelihood, and no active exploitation or public exploit is currently identified.

Affected VersionsENISA

WSO2 API Manager 3.1.0 <3.1.0.351
WSO2 API Manager 3.2.1 <3.2.1.74
WSO2 Identity Server 5.10.0 <5.10.0.360
WSO2 API Manager 3.2.0 <3.2.0.455
WSO2 API Manager 4.0.0 <4.0.0.375
WSO2 API Manager 4.1.0 <4.1.0.238
WSO2 Identity Server 5.11.0 <5.11.0.405

Affected Packages

euvd wso2_api_manager fix: 3.1.0.351, 3.2.0.455, 3.2.1.74, 4.0.0.375, 4.1.0.238
euvd wso2_identity_server fix: 5.10.0.360, 5.11.0.405

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Wso2 Api Manager gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (WSO2) PRIMARY 6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (WSO2) · only source for this CVE.

CVSS VectorVendor: WSO2

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

3
Patch released
Apr 23, 2026 - 15:35 nvd
Patch available
Patch available
Apr 16, 2026 - 11:01 EUVD
CVE Published
Apr 16, 2026 - 09:48 nvd
MEDIUM 6.1

DescriptionCVE.org

The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +30
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

More in Wso2 Api Manager

View all
CVE-2026-5430 CRITICAL POC
10.0 Aug 06

Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
CVE-2026-2053 CRITICAL
10.0 Jun 26

Server-side request forgery in WSO2 API Manager lets unauthenticated remote attackers coerce the gateway into making ser
CVE-2026-1728 CRITICAL
9.8 Aug 06

Privilege escalation in WSO2 API Manager and related Carbon-based products allows a low-privileged user, using a validly
CVE-2025-15039 CRITICAL
9.4 Aug 06

Authentication bypass in WSO2 Identity Server and multiple WSO2 platform products (API Manager, Open Banking AM/IAM/KM,

CVE-2025-8325 HIGH
8.8 May 11

Missing role-based authorization on WSO2 API Manager's Gateway REST API lets any authenticated user invoke privileged Ga
CVE-2026-4249 HIGH
8.6 Jul 06

Persistent denial of service in multiple WSO2 products - including WSO2 API Manager, WSO2 Universal Gateway, WSO2 Traffi
CVE-2025-12737 HIGH
8.4 Sep 03

OS command injection (CWE-78) in WSO2's shared Carbon Console administrative interface allows an authenticated administr
CVE-2025-14260 HIGH
8.3 Oct 28

Server-side request forgery in WSO2 API Manager and related WSO2 products lets a remote attacker direct the server to ar
CVE-2026-3416 HIGH
7.5 Sep 03

Predictable HMAC shared secrets generated by the API Publisher component of WSO2 API Manager allow a sophisticated attac
CVE-2025-8154 HIGH
7.5 May 11

HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic
CVE-2024-2374 HIGH
7.5 Apr 16

The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the

CVE-2025-13173 MEDIUM
6.5 Oct 19

WSO2 Carbon OAuth, as shipped in WSO2 Identity Server, API Manager, and related WSO2 products, can leave session-bound t

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2024-52875 HIGH POC
8.8

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-6024 ADVISORY https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/ ADVISORY https://vuldb.com/vuln/357912

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy