GitHub Advisoryadvisory · Maven

GHSA-cmjc-qp7j-xgwr WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

MEDIUM Published 2025-09-23 Modified 2025-09-27 Official page ↗
Aliases
CVE-2025-4760
Ecosystem
Maven
Packages
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api, org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-09-23

Affected packages

• Maven org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api: < 9.31.117 → fixed in 9.31.117 • Maven org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1: < 9.31.117 → fixed in 9.31.117

Description

An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in WSO2 API Manager components (`carbon-apimgt`) due to insufficient validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document whose contents are later rendered in the UI for other users, leading to attacker-controlled script execution. Likely outcomes include redirection to malicious sites, unauthorized UI modifications, or exfiltration of data accessible to the browser; session hijacking is mitigated by the use of `HttpOnly` session cookies. To remediate, update to version 9.31.117 or above.

Related

Alias · CVE (1)

  • CVE-2025-4760 An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References