Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2025-10853

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

En bref

Sévérité
MEDIUM 5.2
EPSS
EPSS 0.19 % · centile 9 (2026-10-28)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
WSO2
Statut NVD
Analyzed

Description

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.2CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWSO2
CVSS 3.1MEDIUM 5.2CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
WSO2 · WSO2 Open Banking IAMunknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.413
WSO2 · WSO2 API Managerunknown 0 < 3.1.0 ; affected 3.1.0 < 3.1.0.344 ; affected 3.2.0 < 3.2.0.445 ; affected 3.2.1 < 3.2.1.65 ; affected 4.0.0 < 4.0.0.365 ; affected 4.1.0 < 4.1.0.227
WSO2 · WSO2 Identity Serverunknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.373 ; affected 5.11.0 < 5.11.0.417 ; affected 6.0.0 < 6.0.0.247 ; affected 6.1.0 < 6.1.0.246 ; affected 7.0.0 < 7.0.0.122
WSO2 · WSO2 Open Banking AMunknown 0 < 2.0.0 ; affected 2.0.0 < 2.0.0.393
WSO2 · WSO2 Identity Server as Key Managerunknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.363
WSO2 · WSO2 Enterprise Integratorunknown 0 < 6.6.0 ; affected 6.6.0 < 6.6.0.223
WSO2 · WSO2 API Control Planeaffected 4.5.0 < 4.5.0.27
WSO2 · WSO2 Universal Gatewayaffected 4.5.0 < 4.5.0.25
WSO2 · WSO2 Traffic Manageraffected 4.5.0 < 4.5.0.25
WSO2 · org.wso2.carbon.registry:org.wso2.carbon.registry.info.uiaffected 4.7.32 < 4.7.32.14 ; affected 4.7.35 < 4.7.35.11 ; affected 4.7.39 < 4.7.39.9 ; affected 4.7.51 < 4.7.51.4 ; affected 4.8.3 < 4.8.3.9 ; affected 4.8.13 < 4.8.13.6
WSO2 · org.wso2.carbon.registry:org.wso2.carbon.registry.resource.uiaffected 4.7.24 < 4.7.24.7 ; affected 4.7.32 < 4.7.32.14 ; affected 4.7.33 < 4.7.33.13 ; affected 4.7.35 < 4.7.35.11 ; affected 4.7.39 < 4.7.39.9 ; affected 4.7.51 < 4.7.51.4
WSO2 · org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.uiaffected 4.8.19 < 4.8.19.5 ; affected 4.8.21 < 4.8.21.9 ; affected 4.8.28 < 4.8.28.3 ; affected 4.8.30 < 4.8.30.3 ; affected 4.8.32 < 4.8.32.1 ; affected 4.8.33 < 4.8.33.3
WSO2 · org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.uiaffected 6.4.2 < 6.4.2.165 ; affected 6.4.111 < 6.4.111.155 ; affected 6.4.176 < 6.4.176.28 ; affected 6.4.180 < 6.4.180.12 ; affected 6.9.6 < 6.9.6.26 ; affected 6.13.16 < 6.13.16.19

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD