Wso2 Carbon Event Receiver Ui
Monthly
Stored cross-site scripting in the WSO2 Carbon management console lets a high-privileged authenticated console user plant malicious JavaScript in event publisher or receiver property values, which executes when another console user opens the affected details page. The flaw requires adjacent-network access, high privileges, and victim interaction and is rated CVSS 4.3, with session hijacking prevented by httpOnly cookies. No public exploit identified at time of analysis and a vendor patch is available; the combined constraints make this a low real-world priority.
Stored cross-site scripting in the WSO2 Carbon management console lets a high-privileged authenticated console user plant malicious JavaScript in event publisher or receiver property values, which executes when another console user opens the affected details page. The flaw requires adjacent-network access, high privileges, and victim interaction and is rated CVSS 4.3, with session hijacking prevented by httpOnly cookies. No public exploit identified at time of analysis and a vendor patch is available; the combined constraints make this a low real-world priority.