WSO2 API Manager EUVD-2025-211244

Exploitation targets the authentication endpoint of WSO2 API Manager, Identity Server, or API Control Plane, where user-supplied input is reflected into the response without proper output encoding. Per CVSS PR:N the attack is unauthenticated, but it is explicitly gated on user interaction (UI:R): the victim must be induced to follow an attacker-crafted request/link, so successful attacks depend on social engineering. A key LIMITING factor stated by the vendor is that session-related sensitive cookies carry the httpOnly flag, which prevents session hijacking and similar cookie-theft attacks; realistic impact is therefore confined to browser redirection, page content manipulation, and exfiltration of non-httpOnly browser-accessible data. The specific endpoint parameter and the exact affected/fixed versions are not detailed in the available sources.

This is a reflected cross-site scripting flaw (CWE-79) in the authentication endpoint of WSO2 API Manager, Identity Server, and API Control Plane, carrying a CVSS 3.1 base score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The signals point to a moderate, not emergency-grade, priority. The vendor's own decision label is 'this_month' rather than act_now or emergency. There is no CISA KEV listing (no confirmed active exploitation) and no EPSS score was supplied, so exploitation probability cannot be quantified from this data. No public exploit code is referenced. The CVSS vector is internally consistent and matches the description: network-reachable and unauthenticated (PR:N) but gated on user interaction (UI:R), which is exactly what a reflected XSS requires - the victim must be lured into triggering the injected payload. The scope change (S:C) and Low confidentiality/integrity impacts reflect that code executes in the victim's browser context rather than compromising the server. Critically, the vendor states that httpOnly on session cookies blocks session hijacking, which materially caps the integrity/confidentiality fallout. Net: a genuine but user-interaction-dependent client-side issue, appropriately rated Medium - not a high-CVSS-but-illusory risk, but also not a drop-everything remote code execution. No signals conflict with one another.

An attacker crafts a URL targeting the WSO2 authentication endpoint with a malicious JavaScript payload embedded in a user-supplied parameter that is reflected without output encoding, then lures a victim into clicking it (e.g., via phishing). When the victim's browser loads the authentication page, the injected script runs in that context and can redirect the browser to an attacker-controlled site, alter displayed page content, or exfiltrate readable browser data. No public exploit code is identified at time of analysis.