Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher

Summary

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.

Timeline

1. Sep 23, 2025, 2:55 PM UTCCVE published
2. Sep 23, 2025, 7:58 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Sep 23, 2025, 7:58 PM UTCRecord last updated

Affected versions

• WSO2 WSO2 API Manager

  From 3.2.0 · fixed in 3.2.0.428; From 3.2.1 · fixed in 3.2.1.48; From 4.1.0 · fixed in 4.1.0.209; From 4.2.0 · fixed in 4.2.0.145; From 4.3.0 · fixed in 4.3.0.60; From 4.4.0 · fixed in 4.4.0.23; From 4.5.0 · fixed in 4.5.0.7

• WSO2 WSO2 API Control Plane

  From 4.5.0 · fixed in 4.5.0.8

• WSO2 WSO2 Universal Gateway

  From 4.5.0 · fixed in 4.5.0.7

• WSO2 WSO2 Traffic Manager

  From 4.5.0 · fixed in 4.5.0.7

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api

  From 6.7.206 · fixed in 6.7.206.559; From 6.7.210 · fixed in 6.7.210.48; From 9.20.74 · fixed in 9.20.74.365; From 9.28.116 · fixed in 9.28.116.321; From 9.29.120 · fixed in 9.29.120.163; From 9.30.67 · fixed in 9.30.67.80; From 9.31.86 · fixed in 9.31.86.30

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.apiMaven

  fixed in 9.31.117

• org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1Maven

  fixed in 9.31.117

References 1