Riskcovery

CVE-2024-8008

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

State
Published
Severity
5.2 Medium
Published
Jun 2, 2025
Updated
Oct 16, 2026
Reserved
Aug 20, 2024

Read the record on cve.org

Description

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.

This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

Scores

CVSSScoreVectorSource
3.15.2 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWSO2

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

ProductVersions
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.211Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.305Affected
  • 3.2.0 to before 3.2.0.396Affected
  • 3.2.1 to before 3.2.1.28Affected
  • 4.0.0 to before 4.0.0.313Affected
  • 4.1.0 to before 4.1.0.182Affected
  • 4.2.0 to before 4.2.0.121Affected
  • 4.3.0 to before 4.3.0.32Affected
  • 4.4.0 to before 4.4.0.1Affected
  • 4.5.0 to before 4.5.0.16Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.321Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.328Affected
  • 5.11.0 to before 5.11.0.374Affected
  • 6.0.0 to before 6.0.0.216Affected
  • 6.1.0 to before 6.1.0.201Affected
  • 7.0.0 to before 7.0.0.69Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.374Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.354Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.16Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.17Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.16Affected
WSO2 Carbon Identity User Store Configuration UIWSO2
  • 5.14.127 to before 5.14.127.9Affected
  • 5.17.5 to before 5.17.5.289Affected
  • 5.17.118 to before 5.17.118.10Affected
  • 5.18.187 to before 5.18.187.276Affected
  • 5.18.248 to before 5.18.248.22Affected
  • 5.23.8 to before 5.23.8.193Affected
  • 5.24.8 to before 5.24.8.11Affected
  • 5.25.92 to before 5.25.92.104Affected
  • 5.25.705 to before 5.25.705.10Affected
  • 5.25.713 to before 5.25.713.1Affected
  • 5.25.724 to before 5.25.724.1Affected
  • 7.0.78 to before 7.0.78.46Affected
  • 5.25.725 through 5.25.*Not affected
  • 5.27.0 through 5.27.*Not affected
  • 7.5.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.