WSO2 Carbon Console EUVD-2025-211115

Exploitation requires a high-privileged, authenticated user of the WSO2 Carbon management console who can create or edit an event publisher or event receiver and place a malicious script inside one of its property values; these values were emitted into eventPublisher_details.jsp / eventReceiver_details.jsp without XML/HTML encoding. A second console user (the victim) must then open the affected details page for the stored payload to render and execute - so the attack is not self-contained and depends on victim interaction (UI:R). Limiting factors sharply narrow real-world risk: adjacent-network reach only (AV:A, not internet-wide), administrative privileges needed to plant the payload (PR:H), required victim page view (UI:R), and the vendor's note that session hijacking is prevented because session cookies are protected by the httpOnly flag. Affects WSO2 API Manager, Universal Gateway, Traffic Manager, API Control Plane, and the Carbon Event Publisher/Receiver UI components.

This is a medium-severity stored cross-site scripting flaw (CVSS 4.3) in the WSO2 Carbon management console, and the combined signals point to a genuinely LOW real-world priority rather than an urgent threat. The CVSS vector (CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) is the most constraining signal: exploitation requires adjacent-network access (AV:A), high privileges (PR:H - i.e. an authenticated administrative user who can configure event publishers/receivers), AND victim user interaction (UI:R). The scope change (S:C) and the C:L/I:L impacts reflect that injected script executes in a victim's browser rather than compromising the server directly. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is NO evidence of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The vendor (WSO2) self-reported the issue and has shipped a patch (confirmed by the carbon-analytics-common PR #870 diff adding Functions.escapeXml()), which is the strongest confirmed signal here. The only notable caveat the vendor itself documents is a risk-reducing one: session hijacking is NOT possible because session cookies carry the httpOnly flag, further lowering practical impact. Net assessment: a real but low-urgency XSS requiring an already-privileged insider or a chained admin-account compromise to reach a second console user - patch during normal maintenance, not an emergency.

An authenticated WSO2 administrator (or an attacker who has compromised such an account) configures an event publisher or event receiver and embeds a malicious script in one of its XML property values. When another console user later opens the event publisher/receiver details page, the stored payload renders unescaped and executes JavaScript in their browser, allowing the attacker to redirect them to a malicious site or alter the console UI. No public exploit code was identified; exploitation also depends on the victim viewing the affected details page (UI:R) and the attacker holding high privileges (PR:H).