Orta CVSS 4.8
CVE-2025-4760: Api Control Plane: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
Özet bilgiler
- Ürün
- Wso2 Api Control Plane
- CVSS v3.1
- 4.8
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - EPSS
- %0,19 (yüzdelik 8)
- CWE
- CWE-79
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| wso2-api-control-plane | 4.5.0 | 4.5.0 | — |
| wso2-api-manager | 3.2.0 | 3.2.0 | — |
| wso2-api-manager | 3.2.1 | 3.2.1 | — |
| wso2-api-manager | 4.1.0 | 4.1.0 | — |
| wso2-api-manager | 4.2.0 | 4.2.0 | — |
| wso2-api-manager | 4.3.0 | 4.3.0 | — |
| wso2-api-manager | 4.4.0 | 4.4.0 | — |
| wso2-api-manager | 4.5.0 | 4.5.0 | — |
| wso2-traffic-manager | 4.5.0 | 4.5.0 | — |
| wso2-universal-gateway | 4.5.0 | 4.5.0 | — |