Riskcovery

CVE-2025-10853

Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding

State
Published
Severity
5.2 Medium
Published
Nov 5, 2025
Updated
Nov 5, 2025
Reserved
Sep 22, 2025

Read the record on cve.org

Description

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS.

Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.

Scores

CVSSScoreVectorSource
3.15.2 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWSO2

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

ProductVersions
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.413Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.344Affected
  • 3.2.0 to before 3.2.0.445Affected
  • 3.2.1 to before 3.2.1.65Affected
  • 4.0.0 to before 4.0.0.365Affected
  • 4.1.0 to before 4.1.0.227Affected
  • 4.2.0 to before 4.2.0.167Affected
  • 4.3.0 to before 4.3.0.79Affected
  • 4.4.0 to before 4.4.0.43Affected
  • 4.5.0 to before 4.5.0.26Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.373Affected
  • 5.11.0 to before 5.11.0.417Affected
  • 6.0.0 to before 6.0.0.247Affected
  • 6.1.0 to before 6.1.0.246Affected
  • 7.0.0 to before 7.0.0.122Affected
  • 7.1.0 to before 7.1.0.29Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.393Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.363Affected
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.223Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.27Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.25Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.25Affected
org.wso2.carbon.registry:org.wso2.carbon.registry.info.uiWSO2
  • 4.7.32 to before 4.7.32.14Affected
  • 4.7.35 to before 4.7.35.11Affected
  • 4.7.39 to before 4.7.39.9Affected
  • 4.7.51 to before 4.7.51.4Affected
  • 4.8.3 to before 4.8.3.9Affected
  • 4.8.13 to before 4.8.13.6Affected
  • 4.8.32 to before 4.8.32.3Affected
  • 4.8.36 to before 4.8.36.1Affected
  • 4.8.43 to before 4.8.43.1Affected
  • 4.8.47 and laterNot affected
org.wso2.carbon.registry:org.wso2.carbon.registry.resource.uiWSO2
  • 4.7.24 to before 4.7.24.7Affected
  • 4.7.32 to before 4.7.32.14Affected
  • 4.7.33 to before 4.7.33.13Affected
  • 4.7.35 to before 4.7.35.11Affected
  • 4.7.39 to before 4.7.39.9Affected
  • 4.7.51 to before 4.7.51.4Affected
  • 4.8.3 to before 4.8.3.9Affected
  • 4.8.9 to before 4.8.9.5Affected
  • 4.8.12 to before 4.8.12.5Affected
  • 4.8.13 to before 4.8.13.6Affected
  • 4.8.24 to before 4.8.24.3Affected
  • 4.8.32 to before 4.8.32.3Affected
  • 4.8.36 to before 4.8.36.1Affected
  • 4.8.43 to before 4.8.43.1Affected
  • 4.8.47 and laterNot affected
org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.uiWSO2
  • 4.8.19 to before 4.8.19.5Affected
  • 4.8.21 to before 4.8.21.9Affected
  • 4.8.28 to before 4.8.28.3Affected
  • 4.8.30 to before 4.8.30.3Affected
  • 4.8.32 to before 4.8.32.1Affected
  • 4.8.33 to before 4.8.33.3Affected
  • 4.8.34 to before 4.8.34.3Affected
  • 4.8.35 and laterAffected
org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.uiWSO2
  • 6.4.2 to before 6.4.2.165Affected
  • 6.4.111 to before 6.4.111.155Affected
  • 6.4.176 to before 6.4.176.28Affected
  • 6.4.180 to before 6.4.180.12Affected
  • 6.9.6 to before 6.9.6.26Affected
  • 6.13.16 to before 6.13.16.19Affected
  • 6.13.19 to before 6.13.19.12Affected
  • 6.13.27 to before 6.13.27.5Affected
  • 6.13.38 through 6.13.*Not affected
  • 7.0.349 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.