Riskcovery

CVE-2025-8591

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

State
Published
Severity
6.1 Medium
Published
Jul 6, 2026
Updated
Jul 6, 2026
Reserved
Aug 5, 2025

Read the record on cve.org

Description

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application.

By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWSO2

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

ProductVersions
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.381Affected
  • 5.10.0 to before 5.10.0.384Affected
  • 6.0.0 to before 6.0.0.255Affected
  • 7.0.0 to before 7.0.0.131Affected
  • 7.1.0 to before 7.1.0.21Affected
  • 7.1.0 to before 7.1.0.51Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.355Affected
  • 3.2.0 to before 3.2.0.459Affected
  • 3.2.1 to before 3.2.1.78Affected
  • 4.0.0 to before 4.0.0.380Affected
  • 4.1.0 to before 4.1.0.243Affected
  • 4.2.0 to before 4.2.0.183Affected
  • 4.3.0 to before 4.3.0.94Affected
  • 4.4.0 to before 4.4.0.58Affected
  • 4.5.0 to before 4.5.0.43Affected
  • 4.6.0 to before 4.6.0.7Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.44Affected
  • 4.6.0 to before 4.6.0.8Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.42Affected
  • 4.6.0 to before 4.6.0.7Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.42Affected
  • 4.6.0 to before 4.6.0.7Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.404Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.375Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.424Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.