CVEvulnerability

CVE-2024-5848

6.1 MEDIUM Published 2025-02-27 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-02-27
Last modified
2026-06-17
Assigner
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper input validation. User-supplied data is directly included in server responses from vulnerable service endpoints without proper sanitization or encoding, allowing an attacker to inject malicious JavaScript. Successful exploitation could lead to UI manipulation, redirection to malicious websites, or data exfiltration from the browser. While session-related sensitive cookies are protected with the httpOnly flag, mitigating session hijacking risks, the impact may vary depending on gateway-level service restrictions.

Affected configurations

• wso2 api manager 3.1.0 • wso2 api manager 3.2.0 • wso2 api manager 3.2.1 • wso2 api manager 4.0.0 • wso2 api manager 4.1.0 • wso2 api manager 4.2.0 • wso2 api manager 4.3.0

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References