Wso2 Carbon Api Manager Publisher Rest Api
Monthly
Stored cross-site scripting in the WSO2 API Manager Publisher portal allows users holding the Publisher role to upload SVG files whose content is never validated, so embedded script is persisted and later executed in the browser of any user who views the rendered asset. The flaw is scored CVSS 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and its practical reach is narrow because it requires a privileged Publisher account plus victim interaction, while httpOnly-protected session cookies block session hijacking and limit the outcome to browser-context effects such as forced redirects, UI tampering, or reading browser-accessible information. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-prioritised decision label places it in the this-month remediation window rather than an emergency response.
Stored cross-site scripting in the WSO2 API Manager Publisher portal allows users holding the Publisher role to upload SVG files whose content is never validated, so embedded script is persisted and later executed in the browser of any user who views the rendered asset. The flaw is scored CVSS 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and its practical reach is narrow because it requires a privileged Publisher account plus victim interaction, while httpOnly-protected session cookies block session hijacking and limit the outcome to browser-context effects such as forced redirects, UI tampering, or reading browser-accessible information. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the vendor-prioritised decision label places it in the this-month remediation window rather than an emergency response.