Skip to content
CVE PROGRAM SOURCE RECORD5.2 Medium

CVE-2024-8008

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.211affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.305affected
  • 3.2.0 to < 3.2.0.396affected
  • 3.2.1 to < 3.2.1.28affected
  • 4.0.0 to < 4.0.0.313affected
  • 4.1.0 to < 4.1.0.182affected
  • 4.2.0 to < 4.2.0.121affected
  • 4.3.0 to < 4.3.0.32affected
  • 4.4.0 to < 4.4.0.1affected
  • 4.5.0 to < 4.5.0.16affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.321affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.328affected
  • 5.11.0 to < 5.11.0.374affected
  • 6.0.0 to < 6.0.0.216affected
  • 6.1.0 to < 6.1.0.201affected
  • 7.0.0 to < 7.0.0.69affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.374affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.354affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.16affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.17affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.16affected

WSO2 WSO2 Carbon Identity User Store Configuration UI

Default version status: unknown

  • 5.14.127 to < 5.14.127.9affected
  • 5.17.5 to < 5.17.5.289affected
  • 5.17.118 to < 5.17.118.10affected
  • 5.18.187 to < 5.18.187.276affected
  • 5.18.248 to < 5.18.248.22affected
  • 5.23.8 to < 5.23.8.193affected
  • 5.24.8 to < 5.24.8.11affected
  • 5.25.92 to < 5.25.92.104affected
  • 5.25.705 to < 5.25.705.10affected
  • 5.25.713 to < 5.25.713.1affected
  • 5.25.724 to < 5.25.724.1affected
  • 7.0.78 to < 7.0.78.46affected
  • 5.25.725 to ≤ 5.25.*unaffected
  • 5.27.0 to ≤ 5.27.*unaffected
  • 7.5.12 to ≤ *unaffected

References