WSO2 API Manager EUVD-2025-209758

Exploitation requires that the target be an affected WSO2 component (API Manager 4.1.0-4.5.0, Universal Gateway/Traffic Manager/API Control Plane 4.5.0, or Carbon API Gateway/Management Implementation 9.20.74-9.31.86) exposing the Webhook API invocation path, which accepts user-supplied HTTP request headers and reflects them into responses without sanitization. No authentication is required per the CVSS vector (PR:N) and no user interaction (UI:N), so remote unauthenticated requests against a reachable Webhook endpoint suffice. The principal limiting factors are: the Webhook API functionality must be in use/reachable, the instance must be a pre-fix build (each product line has a specific patched sub-version such as 4.5.0.20 for API Manager 4.5.0), and realized harm (cache poisoning, security-header weakening, cookie/session abuse) depends on how downstream clients or proxies process the injected headers rather than on the gateway alone.

Signals here are consistent and point to a genuine but moderate-priority issue rather than an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) indicates a network-reachable, low-complexity, unauthenticated flaw with high integrity impact and no confidentiality or availability loss - appropriate for an HTTP response-header injection (CWE-74) weakness. The exploitation signals temper this: EPSS is very low at 0.04% (12th percentile), the CVE is NOT on CISA KEV, and no public exploit was identified at time of analysis. CISA SSVC reinforces low urgency (Exploitation: none, Automatable: no, Technical Impact: partial). There is no conflict between the signals: a high base score driven solely by integrity impact, combined with no observed or predicted exploitation and a vendor patch already available, means this is a 'patch in normal cycle' item rather than a drop-everything priority. One nuance to verify: the description frames impact as header manipulation that could aid session hijacking or cache poisoning, which is a downstream/client-side effect - the CVSS I:H captures response integrity, but real-world harm depends on what a victim browser does with the injected headers.

A remote, unauthenticated attacker sends a Webhook API invocation to an affected WSO2 gateway supplying crafted values in HTTP request headers, which the component reflects into HTTP responses without validation. By injecting or overwriting response headers (e.g. Set-Cookie or cache-control directives), the attacker can poison caches, weaken security headers, or set/leak cookie values to facilitate session hijacking. No public proof-of-concept is known at time of analysis, and because attack complexity is low this would require only well-formed malicious requests rather than specialized tooling.