Description
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 – < 3.2.0.433, 3.2.1 – < 3.2.1.53, 4.1.0 – < 4.1.0.215, 4.2.0 – < 4.2.0.153, 4.3.0 – < 4.3.0.66, 4.4.0 – < 4.4.0.29, 4.5.0 – < 4.5.0.11 | 3.2.0.433 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.11 | 4.5.0.11 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.11 | 4.5.0.11 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.12 | 4.5.0.12 |
| WSO2 | WSO2 Carbon Event Publisher UI | 5.2.26 – < 5.2.26.19, 5.2.41 – < 5.2.41.6, 5.2.57 – < 5.2.57.7, 5.3.5 – < 5.3.5.4, 5.3.11 – < 5.3.11.4, 5.3.15 – < 5.3.15.3, 5.3.20 – < 5.3.20.1 | 5.2.26.19 |
| WSO2 | WSO2 Carbon Event Receiver UI | 5.2.26 – < 5.2.26.19, 5.2.41 – < 5.2.41.6, 5.2.57 – < 5.2.57.7, 5.3.5 – < 5.3.5.4, 5.3.11 – < 5.3.11.4, 5.3.15 – < 5.3.15.3, 5.3.20 – < 5.3.20.1 | 5.2.26.19 |