Description (CNA)
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WSO2 / WSO2 API Manager | unknown 0 before 3.2.0; affected 3.2.0 before 3.2.0.433; affected 3.2.1 before 3.2.1.53; affected 4.1.0 before 4.1.0.215; affected 4.2.0 before 4.2.0.153; affected 4.3.0 before 4.3.0.66; affected 4.4.0 before 4.4.0.29; affected 4.5.0 before 4.5.0.11 |
| WSO2 / WSO2 Universal Gateway | unknown 0 before 4.5.0; affected 4.5.0 before 4.5.0.11 |
| WSO2 / WSO2 Traffic Manager | unknown 0 before 4.5.0; affected 4.5.0 before 4.5.0.11 |
| WSO2 / WSO2 API Control Plane | unknown 0 before 4.5.0; affected 4.5.0 before 4.5.0.12 |
| WSO2 / WSO2 Carbon Event Publisher UI | affected 5.2.26 before 5.2.26.19; affected 5.2.41 before 5.2.41.6; affected 5.2.57 before 5.2.57.7; affected 5.3.5 before 5.3.5.4; affected 5.3.11 before 5.3.11.4; affected 5.3.15 before 5.3.15.3; affected 5.3.20 before 5.3.20.1 |
| WSO2 / WSO2 Carbon Event Receiver UI | affected 5.2.26 before 5.2.26.19; affected 5.2.41 before 5.2.41.6; affected 5.2.57 before 5.2.57.7; affected 5.3.5 before 5.3.5.4; affected 5.3.11 before 5.3.11.4; affected 5.3.15 before 5.3.15.3; affected 5.3.20 before 5.3.20.1 |
CWE
CWE-79
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/
- https://github.com/wso2/carbon-analytics-common/pull/870
ADP enrichment
No English description supplied.
No references supplied.