Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-4867

Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.2.0unknown
  • 3.2.0 to < 3.2.0.408affected
  • 3.2.1 to < 3.2.1.32affected
  • 4.0.0 to < 4.0.0.293affected
  • 4.1.0 to < 4.1.0.187affected

References