Wso2 Carbon Api Gateway
Monthly
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic Manager, API Control Plane, Carbon API Gateway, and Carbon API Management Implementation) lets unauthenticated remote attackers inject or overwrite arbitrary HTTP response headers through the Webhook API invocation path. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - any reachable, pre-fix Webhook endpoint is sufficient, and the confidentiality-neutral but integrity-high rating (C:N/I:H/A:N, base 7.5) reflects that tampered headers can poison browser caches, weaken security headers, or inject cookie values to enable session hijacking. Exploitation is not confirmed to be active and no public exploit code has been identified at time of analysis; EPSS is low at 0.04% (12th percentile), and CISA's SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. Patches are available per the vendor advisory.
HTTP response header injection in WSO2 API Manager and its companion WSO2 gateway components (Universal Gateway, Traffic Manager, API Control Plane, Carbon API Gateway, and Carbon API Management Implementation) lets unauthenticated remote attackers inject or overwrite arbitrary HTTP response headers through the Webhook API invocation path. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed - any reachable, pre-fix Webhook endpoint is sufficient, and the confidentiality-neutral but integrity-high rating (C:N/I:H/A:N, base 7.5) reflects that tampered headers can poison browser caches, weaken security headers, or inject cookie values to enable session hijacking. Exploitation is not confirmed to be active and no public exploit code has been identified at time of analysis; EPSS is low at 0.04% (12th percentile), and CISA's SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. Patches are available per the vendor advisory.