Riskcovery

CVE-2025-4760

Authenticated Stored Cross-Site Scripting (XSS) in Multiple WSO2 Products via API Document Upload in Publisher

State
Published
Severity
4.8 Medium
Published
Sep 23, 2025
Updated
Sep 23, 2025
Reserved
May 15, 2025

Read the record on cve.org

Description

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.

A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NWSO2

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 3.2.0Unknown
  • 3.2.0 to before 3.2.0.428Affected
  • 3.2.1 to before 3.2.1.48Affected
  • 4.1.0 to before 4.1.0.209Affected
  • 4.2.0 to before 4.2.0.145Affected
  • 4.3.0 to before 4.3.0.60Affected
  • 4.4.0 to before 4.4.0.23Affected
  • 4.5.0 to before 4.5.0.7Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.8Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.7Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.7Affected
WSO2 Carbon API Management APIWSO2
  • 6.7.206 to before 6.7.206.559Affected
  • 6.7.210 to before 6.7.210.48Affected
  • 9.20.74 to before 9.20.74.365Affected
  • 9.28.116 to before 9.28.116.321Affected
  • 9.29.120 to before 9.29.120.163Affected
  • 9.30.67 to before 9.30.67.80Affected
  • 9.31.86 to before 9.31.86.30Affected
  • 9.31.117 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.