WSO2 Identity Server EUVD-2025-210428

The attacker requires no authentication (PR:N per CVSS vector) and the vulnerability is network-reachable (AV:N), but exploitation is gated by mandatory user interaction - a victim must click or follow the attacker-crafted URL (UI:R). The vulnerable parameter is a URL query parameter that the application reflects into the response without encoding; the specific parameter name and endpoint are not disclosed in available data. Session hijacking is structurally blocked because session-related cookies carry httpOnly flags, meaning injected JavaScript cannot read them. Exploitation is therefore limited to: browser redirects to attacker-controlled sites, UI manipulation of the rendered WSO2 page, and theft of any non-httpOnly browser data (e.g., local storage values, form field contents, OAuth fragments visible in the DOM). The vulnerability exists in the default application behavior - no non-default feature flag or unusual configuration is required. Exploitation is limited to users who can be induced to click a crafted link, making phishing the primary delivery mechanism.

CVSS 6.1 Medium (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately reflects a classic reflected XSS profile: network-reachable, trivially exploitable, but gated by required user interaction (UI:R) and constrained to low-severity confidentiality and integrity impacts. The scope change (S:C) elevates the score beyond a strict local-impact XSS. EPSS data is not provided; given no KEV listing and no known POC, real-world exploitation probability should be treated as unconfirmed but not negligible - WSO2 products are used in identity-critical enterprise environments where even UI-required XSS can be weaponized via phishing. The httpOnly mitigation is a meaningful differentiator: session hijacking, the highest-value XSS outcome, is structurally blocked, leaving phishing redirects, UI defacement, and non-session data exfiltration as residual threats. The breadth of affected products (eight distinct WSO2 components) increases aggregate exposure surface. No SSVC decision-tree data or EPSS score was provided - risk prioritization should weight the sensitivity of the deployment (identity provider vs. internal traffic manager) rather than CVSS alone.

An attacker identifies a WSO2 Identity Server or API Manager instance exposed to the internet, crafts a URL containing a malicious JavaScript payload embedded in a vulnerable query parameter, and delivers it to a logged-in user via a phishing email or social engineering message. When the victim clicks the link, their browser loads the legitimate WSO2 page with the injected script executing in the WSO2 origin's context, potentially redirecting them to a credential-harvesting site or silently exfiltrating form data or OAuth tokens visible to JavaScript. No public proof-of-concept code has been identified, but the attack pattern is well-understood and requires no specialized tooling beyond basic URL crafting.