Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2024-3509

Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users. While this issue enables persistent client-side script execution, session-related cookies remain protected with the httpOnly flag, preventing session hijacking.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.202affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.275affected
  • 3.2.0 to < 3.2.0.392affected
  • 3.2.1 to < 3.2.1.19affected
  • 4.0.0 to < 4.0.0.308affected
  • 4.1.0 to < 4.1.0.171affected
  • 4.2.0 to < 4.2.0.107affected
  • 4.3.0 to < 4.3.0.21affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.325affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.345affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.292affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.296affected
  • 5.11.0 to < 5.11.0.333affected
  • 6.0.0 to < 6.0.0.181affected
  • 6.1.0 to < 6.1.0.142affected
  • 7.0.0 to < 7.0.0.9affected

WSO2 WSO2 Carbon Registry Resources UI

Default version status: unknown

  • 4.7.24 to < 4.7.24.6affected
  • 4.7.32 to < 4.7.32.10affected
  • 4.7.33 to < 4.7.33.8affected
  • 4.7.35 to < 4.7.35.8affected
  • 4.7.39 to < 4.7.39.6affected
  • 4.7.51 to < 4.7.51.2affected
  • 4.8.3 to < 4.8.3.7affected
  • 4.8.9 to < 4.8.9.3affected
  • 4.8.12 to < 4.8.12.2affected
  • 4.8.13 to < 4.8.13.4affected
  • 4.8.24 to < 4.8.24.1affected
  • 4.8.32 to < 4.8.32.2affected
  • 4.8.35 to ≤ *unaffected

References