EUVD-2025-210645
GHSA-p462-ppqc-2w4x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered crafted link requires active user click (UI:R, PR:N); impact is limited to overwriting displayed API definitions with no confidentiality or availability consequence (I:L only).
Primary rating from Vendor (ed10eef1-636d-4fbe-9993-6890dfa878f8).
CVSS VectorVendor: ed10eef1-636d-4fbe-9993-6890dfa878f8
Lifecycle Timeline
2DescriptionCVE.org
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal.
By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
AnalysisAI
WSO2 API Manager's Swagger UI Try-out console in the API Publisher portal accepts an externally supplied OpenAPI/Swagger definition URL, allowing that definition to override the legitimate API specifications rendered to users. An attacker who tricks an API Publisher user into visiting a crafted URL can substitute attacker-controlled backend endpoints for real ones, potentially harvesting authentication tokens, credentials, or other sensitive payloads submitted via the Try-out console. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; exploitation requires user interaction, confining realistic risk to targeted social engineering against developer or API management personnel.
Technical ContextAI
The vulnerability resides in the Swagger UI 'Try It Out' component embedded within WSO2 API Manager's API Publisher documentation interface. Swagger UI is an open-source tool for rendering and interacting with OpenAPI/Swagger specification files; it natively supports loading remote definition URLs. The flaw, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), allows a URL parameter to inject an external OpenAPI specification, replacing the legitimate definitions displayed in the portal without sanitization or origin validation. The affected components are WSO2 API Manager 4.2.0 prior to patch level 4.2.0.183 and version 4.1.0 prior to 4.1.0.212, as confirmed by ENISA EUVD-2025-210645 and the vendor security advisory WSO2-2025-4306.
RemediationAI
Upgrade WSO2 API Manager to version 4.2.0.183 or later on the 4.2.0 release track, or to 4.1.0.212 or later on the 4.1.0 release track, as documented in vendor advisory WSO2-2025-4306 at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4306/. Where immediate patching is not feasible, restrict access to the API Publisher portal to internal trusted networks or require VPN access, substantially reducing the attack surface since exploitation depends on delivering a crafted URL to a portal-authenticated user. If the product configuration supports disabling the Swagger UI Try-out console or external URL loading, doing so eliminates the attack vector entirely at the cost of developer usability. No generic workarounds should be assumed sufficient without vendor confirmation.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today