Api Control Plane
Monthly
Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis.
Authenticated remote code execution affects multiple WSO2 products (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0-4.6.0, Universal Gateway 4.5.0, and Traffic Manager 4.5.0-4.6.0) through an unrestricted file upload exposed via a system REST API. An administrator-level attacker can place an arbitrary file at a user-controlled path and trigger code execution on the host. No public exploit identified at time of analysis, EPSS is low at 0.28%, and a vendor patch is available per WSO2 advisory WSO2-2025-4849.
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in WSO2 API Manager 2.0.0 through 3.2.1 and WSO2 API Control Plane 4.5.0 allows an authenticated low-privileged user to reach certain internal SOAP Admin Services and System REST APIs and perform unauthorized operations, including disclosure of server-level information. The issue is network-reachable with low attack complexity and confidentiality-only impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and APIs exposed through the API Manager's API Gateway data plane are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated remote attackers can exploit missing authentication and authorization checks in the WSO2 API Manager keymanager-operations Dynamic Client Registration endpoint to mint elevated-privilege access tokens and potentially obtain administrative control. WSO2 API Manager 3.2.0 through 4.5.0 and WSO2 API Control Plane 4.5.0 are affected, with a CVSS score of 9.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.71% (53rd percentile).
Administrative users of WSO2 API Manager (3.0.0 through 4.4.0) and related WSO2 components such as API Control Plane 4.5.0 can achieve arbitrary code execution on the server by deploying a crafted Siddhi execution plan through the event processor admin service, which fails to validate embedded Java code. Because the flaw is reachable only over the SOAP admin services with high-privilege credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), it is a post-authentication escalation path for a trusted-but-malicious or compromised administrator rather than an anonymous attack vector; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.33% (56th percentile).
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis.
Authenticated remote code execution affects multiple WSO2 products (API Manager 4.2.0-4.6.0, API Control Plane 4.5.0-4.6.0, Universal Gateway 4.5.0, and Traffic Manager 4.5.0-4.6.0) through an unrestricted file upload exposed via a system REST API. An administrator-level attacker can place an arbitrary file at a user-controlled path and trigger code execution on the host. No public exploit identified at time of analysis, EPSS is low at 0.28%, and a vendor patch is available per WSO2 advisory WSO2-2025-4849.
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services, specifically in the event. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. Rated medium severity (CVSS 5.2), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. No vendor patch available.
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint. Rated medium severity (CVSS 6.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in WSO2 API Manager 2.0.0 through 3.2.1 and WSO2 API Control Plane 4.5.0 allows an authenticated low-privileged user to reach certain internal SOAP Admin Services and System REST APIs and perform unauthorized operations, including disclosure of server-level information. The issue is network-reachable with low attack complexity and confidentiality-only impact (CVSS 3.1 base 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and APIs exposed through the API Manager's API Gateway data plane are explicitly unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated remote attackers can exploit missing authentication and authorization checks in the WSO2 API Manager keymanager-operations Dynamic Client Registration endpoint to mint elevated-privilege access tokens and potentially obtain administrative control. WSO2 API Manager 3.2.0 through 4.5.0 and WSO2 API Control Plane 4.5.0 are affected, with a CVSS score of 9.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.71% (53rd percentile).
Administrative users of WSO2 API Manager (3.0.0 through 4.4.0) and related WSO2 components such as API Control Plane 4.5.0 can achieve arbitrary code execution on the server by deploying a crafted Siddhi execution plan through the event processor admin service, which fails to validate embedded Java code. Because the flaw is reachable only over the SOAP admin services with high-privilege credentials (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2), it is a post-authentication escalation path for a trusted-but-malicious or compromised administrator rather than an anonymous attack vector; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and EPSS is low at 0.33% (56th percentile).
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.