Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.2.0.480, 3.2.1.99, 4.1.0.265, 4.2.0.205, 4.3.0.117, and 13 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
The authentication endpoint in multiple WSO2 products fails to properly sanitize or encode data it reflects in error messages, allowing attackers to inject scripts that run in a victim's browser. This could let an attacker redirect users to malicious sites, alter the displayed page, or retrieve information, though session hijacking is not possible due to httpOnly cookie protection.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitization or encoding. This allows an attacker to inject malicious scripts that can be executed in the context of a victim's browser. Successful exploitation enables an attacker to perform actions within the user's browser, such as redirecting the user to a malicious website, modifying the web page's user interface, or retrieving information. However, due to the httpOnly flag on session-related cookies, session hijacking or similar attacks are not possible.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- WSO2 WSO2 API Manager
From 3.2.0 · fixed in 3.2.0.480; From 3.2.1 · fixed in 3.2.1.99; From 4.1.0 · fixed in 4.1.0.265; From 4.2.0 · fixed in 4.2.0.205; From 4.3.0 · fixed in 4.3.0.117; From 4.4.0 · fixed in 4.4.0.80; From 4.5.0 · fixed in 4.5.0.65; From 4.6.0 · fixed in 4.6.0.29; From 4.7.0 · fixed in 4.7.0.1
- WSO2 WSO2 API Control Plane
From 4.5.0 · fixed in 4.5.0.66; From 4.6.0 · fixed in 4.6.0.30; From 4.7.0 · fixed in 4.7.0.1
- WSO2 WSO2 Identity Server
From 5.10.0 · fixed in 5.10.0.399; From 5.11.0 · fixed in 5.11.0.446; From 6.0.0 · fixed in 6.0.0.272; From 6.1.0 · fixed in 6.1.0.274; From 7.0.0 · fixed in 7.0.0.155; From 7.1.0 · fixed in 7.1.0.65; From 7.2.0 · fixed in 7.2.0.26