CVE-2025-6623
Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
At a glance
- Severity
- MEDIUM 4.3
- EPSS
- EPSS 0.27 % · percentile 18 (2026-10-27)
- State
- PUBLISHED
- Published
- Updated
- Assigner
- WSO2
- NVD status
- Awaiting Analysis
Description
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | WSO2 |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary) |
Weaknesses (CWE)
European references
- ENISA EUVD · EUVD-2025-211115
- GCVE · GCVE-0-2025-6623
Affected products
| Product | Versions |
|---|---|
| WSO2 · WSO2 API Manager | unknown 0 < 3.2.0 ; affected 3.2.0 < 3.2.0.433 ; affected 3.2.1 < 3.2.1.53 ; affected 4.1.0 < 4.1.0.215 ; affected 4.2.0 < 4.2.0.153 ; affected 4.3.0 < 4.3.0.66 |
| WSO2 · WSO2 Universal Gateway | unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.11 |
| WSO2 · WSO2 Traffic Manager | unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.11 |
| WSO2 · WSO2 API Control Plane | unknown 0 < 4.5.0 ; affected 4.5.0 < 4.5.0.12 |
| WSO2 · WSO2 Carbon Event Publisher UI | affected 5.2.26 < 5.2.26.19 ; affected 5.2.41 < 5.2.41.6 ; affected 5.2.57 < 5.2.57.7 ; affected 5.3.5 < 5.3.5.4 ; affected 5.3.11 < 5.3.11.4 ; affected 5.3.15 < 5.3.15.3 |
| WSO2 · WSO2 Carbon Event Receiver UI | affected 5.2.26 < 5.2.26.19 ; affected 5.2.41 < 5.2.41.6 ; affected 5.2.57 < 5.2.57.7 ; affected 5.3.5 < 5.3.5.4 ; affected 5.3.11 < 5.3.11.4 ; affected 5.3.15 < 5.3.15.3 |
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/
- https://github.com/wso2/carbon-analytics-common/pull/870
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |