Description
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.
A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 – < 3.2.0.428, 3.2.1 – < 3.2.1.48, 4.1.0 – < 4.1.0.209, 4.2.0 – < 4.2.0.145, 4.3.0 – < 4.3.0.60, 4.4.0 – < 4.4.0.23, 4.5.0 – < 4.5.0.7 | 3.2.0.428 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.8 | 4.5.0.8 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.7 | 4.5.0.7 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.7 | 4.5.0.7 |
| WSO2 | WSO2 Carbon API Management API | 6.7.206 – < 6.7.206.559, 6.7.210 – < 6.7.210.48, 9.20.74 – < 9.20.74.365, 9.28.116 – < 9.28.116.321, 9.29.120 – < 9.29.120.163, 9.30.67 – < 9.30.67.80, 9.31.86 – < 9.31.86.30 | 6.7.206.559 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api | < 9.31.117 | 9.31.117 | GHSA-cmjc-qp7j-xgwr |
| Maven | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1 | < 9.31.117 | 9.31.117 | GHSA-cmjc-qp7j-xgwr |