Medium
Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Announced Group revision 1
Original source ↗CVE-2025-6623
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-6623
WSO2 API Manager
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
WSO2 Universal Gateway
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
WSO2 Traffic Manager
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
WSO2 API Control Plane
Source reference: /containers/cna/affected/3/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
WSO2 Carbon Event Publisher UI
Source reference: /containers/cna/affected/4/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
WSO2 Carbon Event Receiver UI
Source reference: /containers/cna/affected/5/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "3.2.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.0.433",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.1",
"lessThan": "3.2.1.53",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.1.0",
"lessThan": "4.1.0.215",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.2.0",
"lessThan": "4.2.0.153",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.3.0",
"lessThan": "4.3.0.66",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.4.0",
"lessThan": "4.4.0.29",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.11",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Universal Gateway",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "4.5.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.11",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Traffic Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "4.5.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.11",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 API Control Plane",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "4.5.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.5.0",
"lessThan": "4.5.0.12",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Event Publisher UI",
"versions": [
{
"status": "affected",
"version": "5.2.26",
"lessThan": "5.2.26.19",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.2.41",
"lessThan": "5.2.41.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.2.57",
"lessThan": "5.2.57.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.5",
"lessThan": "5.3.5.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.11",
"lessThan": "5.3.11.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.15",
"lessThan": "5.3.15.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.20",
"lessThan": "5.3.20.1",
"versionType": "custom"
}
],
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui",
"defaultStatus": "unknown"
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Event Receiver UI",
"versions": [
{
"status": "affected",
"version": "5.2.26",
"lessThan": "5.2.26.19",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.2.41",
"lessThan": "5.2.41.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.2.57",
"lessThan": "5.2.57.7",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.5",
"lessThan": "5.3.5.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.11",
"lessThan": "5.3.11.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.15",
"lessThan": "5.3.15.3",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.3.20",
"lessThan": "5.3.20.1",
"versionType": "custom"
}
],
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui",
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2025-6623
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #42570 · Revision 1
- Added to Heist Feed
- Publisher date