Description
A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling browser-based attacks. Exploitation may result in redirection to malicious websites, UI manipulation, or unauthorized data access from the victim’s browser. However, session-related cookies are protected with the httpOnly flag, which mitigates session hijacking via this vector.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WSO2 WSO2 Identity Server
Default version status: unaffected
0 to < 6.0.0unknown6.0.0 to < 6.0.0.247affected6.1.0 to < 6.1.0.246affected7.0.0 to < 7.0.0.122affected7.1.0 to < 7.1.0.29affected
WSO2 WSO2 API Manager
Default version status: unaffected
0 to < 4.2.0unknown4.2.0 to < 4.2.0.150affected4.3.0 to < 4.3.0.63affected4.4.0 to < 4.4.0.26affected4.5.0 to < 4.5.0.10affected
WSO2 WSO2 API Control Plane
Default version status: unaffected
4.5.0 to < 4.5.0.11affected