Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2025-10853

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

At a glance

Severity
MEDIUM 5.2
EPSS
EPSS 0.19 % · percentile 9 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
WSO2
NVD status
Analyzed

Description

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 5.2CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWSO2
CVSS 3.1MEDIUM 5.2CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
WSO2 · WSO2 Open Banking IAMunknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.413
WSO2 · WSO2 API Managerunknown 0 < 3.1.0 ; affected 3.1.0 < 3.1.0.344 ; affected 3.2.0 < 3.2.0.445 ; affected 3.2.1 < 3.2.1.65 ; affected 4.0.0 < 4.0.0.365 ; affected 4.1.0 < 4.1.0.227
WSO2 · WSO2 Identity Serverunknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.373 ; affected 5.11.0 < 5.11.0.417 ; affected 6.0.0 < 6.0.0.247 ; affected 6.1.0 < 6.1.0.246 ; affected 7.0.0 < 7.0.0.122
WSO2 · WSO2 Open Banking AMunknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.393
WSO2 · WSO2 Identity Server as Key Managerunknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.363
WSO2 · WSO2 Enterprise Integratorunknown 0 < 6.6.0 ; affected 6.6.0 < 6.6.0.223
WSO2 · WSO2 API Control Planeaffected 4.5.0 < 4.5.0.27
WSO2 · WSO2 Universal Gatewayaffected 4.5.0 < 4.5.0.25
WSO2 · WSO2 Traffic Manageraffected 4.5.0 < 4.5.0.25
WSO2 · org.wso2.carbon.registry:org.wso2.carbon.registry.info.uiaffected 4.7.32 < 4.7.32.14 ; affected 4.7.35 < 4.7.35.11 ; affected 4.7.39 < 4.7.39.9 ; affected 4.7.51 < 4.7.51.4 ; affected 4.8.3 < 4.8.3.9 ; affected 4.8.13 < 4.8.13.6
WSO2 · org.wso2.carbon.registry:org.wso2.carbon.registry.resource.uiaffected 4.7.24 < 4.7.24.7 ; affected 4.7.32 < 4.7.32.14 ; affected 4.7.33 < 4.7.33.13 ; affected 4.7.35 < 4.7.35.11 ; affected 4.7.39 < 4.7.39.9 ; affected 4.7.51 < 4.7.51.4
WSO2 · org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.uiaffected 4.8.19 < 4.8.19.5 ; affected 4.8.21 < 4.8.21.9 ; affected 4.8.28 < 4.8.28.3 ; affected 4.8.30 < 4.8.30.3 ; affected 4.8.32 < 4.8.32.1 ; affected 4.8.33 < 4.8.33.3
WSO2 · org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.uiaffected 6.4.2 < 6.4.2.165 ; affected 6.4.111 < 6.4.111.155 ; affected 6.4.176 < 6.4.176.28 ; affected 6.4.180 < 6.4.180.12 ; affected 6.9.6 < 6.9.6.26 ; affected 6.13.16 < 6.13.16.19

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD