CVE-2025-4760
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
- CVSS 3.1
- 4.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-25)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- wso2:api_control_plane
- wso2:api_manager
- wso2:traffic_manager
- wso2:universal_gateway
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-cmjc-qp7j-xgwr | Maven | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api | <9.31.117 | 9.31.117 |
| GHSA-cmjc-qp7j-xgwr | Maven | org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1 | <9.31.117 | 9.31.117 |