FKIE_CVE-2025-10853

Vulnerability from fkie_nvd - Published: 2025-11-05 20:15 - Updated: 2026-06-17 08:29
Severity
5.2 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS. Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.
References
ed10eef1-636d-4fbe-9993-6890dfa878f8https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4486/Vendor Advisory
Impacted products
Vendor Product Version
wso2 api_control_plane 4.5.0
wso2 api_manager 3.1.0
wso2 api_manager 3.2.0
wso2 api_manager 3.2.1
wso2 api_manager 4.0.0
wso2 api_manager 4.1.0
wso2 api_manager 4.2.0
wso2 api_manager 4.3.0
wso2 api_manager 4.4.0
wso2 api_manager 4.5.0
wso2 enterprise_integrator 6.6.0
wso2 identity_server 5.10.0
wso2 identity_server 5.11.0
wso2 identity_server 6.0.0
wso2 identity_server 6.1.0
wso2 identity_server 7.0.0
wso2 identity_server 7.1.0
wso2 identity_server_as_key_manager 5.10.0
wso2 open_banking_am 2.0.0
wso2 open_banking_iam 2.0.0
wso2 traffic_manager 4.5.0
wso2 universal_gateway 4.5.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.413",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.344",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.445",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.65",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.365",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.227",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.167",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.79",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.43",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.5.0.26",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.373",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.417",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.247",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.246",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.122",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.1.0.29",
              "status": "affected",
              "version": "7.1.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.393",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.363",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.223",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Control Plane",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.27",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Universal Gateway",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.25",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Traffic Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.5.0.25",
              "status": "affected",
              "version": "4.5.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.registry:org.wso2.carbon.registry.info.ui",
          "product": "org.wso2.carbon.registry:org.wso2.carbon.registry.info.ui",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.32.14",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.11",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.9",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.4",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.9",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.6",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.3",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.1",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.1",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "4.8.47",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.registry:org.wso2.carbon.registry.resource.ui",
          "product": "org.wso2.carbon.registry:org.wso2.carbon.registry.resource.ui",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.7.24.7",
              "status": "affected",
              "version": "4.7.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.32.14",
              "status": "affected",
              "version": "4.7.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.33.13",
              "status": "affected",
              "version": "4.7.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.35.11",
              "status": "affected",
              "version": "4.7.35",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.39.9",
              "status": "affected",
              "version": "4.7.39",
              "versionType": "custom"
            },
            {
              "lessThan": "4.7.51.4",
              "status": "affected",
              "version": "4.7.51",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.3.9",
              "status": "affected",
              "version": "4.8.3",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.9.5",
              "status": "affected",
              "version": "4.8.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.12.5",
              "status": "affected",
              "version": "4.8.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.13.6",
              "status": "affected",
              "version": "4.8.13",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.24.3",
              "status": "affected",
              "version": "4.8.24",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.3",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.36.1",
              "status": "affected",
              "version": "4.8.36",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.43.1",
              "status": "affected",
              "version": "4.8.43",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "4.8.47",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.ui",
          "product": "org.wso2.carbon.governance:org.wso2.carbon.governance.wsdltool.ui",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "4.8.19.5",
              "status": "affected",
              "version": "4.8.19",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.21.9",
              "status": "affected",
              "version": "4.8.21",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.28.3",
              "status": "affected",
              "version": "4.8.28",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.30.3",
              "status": "affected",
              "version": "4.8.30",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.32.1",
              "status": "affected",
              "version": "4.8.32",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.33.3",
              "status": "affected",
              "version": "4.8.33",
              "versionType": "custom"
            },
            {
              "lessThan": "4.8.34.3",
              "status": "affected",
              "version": "4.8.34",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "affected",
              "version": "4.8.35",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui",
          "product": "org.wso2.carbon.identity.inbound.auth.oauth2:org.wso2.carbon.identity.oauth.ui",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.4.2.165",
              "status": "affected",
              "version": "6.4.2",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.111.155",
              "status": "affected",
              "version": "6.4.111",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.176.28",
              "status": "affected",
              "version": "6.4.176",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.180.12",
              "status": "affected",
              "version": "6.4.180",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.6.26",
              "status": "affected",
              "version": "6.9.6",
              "versionType": "custom"
            },
            {
              "lessThan": "6.13.16.19",
              "status": "affected",
              "version": "6.13.16",
              "versionType": "custom"
            },
            {
              "lessThan": "6.13.19.12",
              "status": "affected",
              "version": "6.13.19",
              "versionType": "custom"
            },
            {
              "lessThan": "6.13.27.5",
              "status": "affected",
              "version": "6.13.27",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.38",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0.349",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:api_control_plane:4.5.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "DEEA7DB5-BBF7-44A4-9FB6-0D235A44C680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:4.5.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "D47B760D-5418-4FB0-88F0-3F78BAFF63E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "32CE7893-AD1A-49E5-BD1A-5E9C2DEB8764",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "EA76533A-5BED-4BDC-B348-EB3D3FDFB110",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "C1EFBD0F-9664-4EF3-9908-C72B1318F68F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server:7.1.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "A5358E6E-8C01-408D-8692-B1A326DC630F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:traffic_manager:4.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7413107-D7B2-49AE-AC46-52E7BFCD6ED8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:wso2:universal_gateway:4.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "61636553-C25E-44DF-93D7-EB3E1056D1DC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS.\n\nSuccessful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking."
    }
  ],
  "id": "CVE-2025-10853",
  "lastModified": "2026-06-17T08:29:09.440",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 2.7,
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-10853",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-05T19:51:26.535789Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-05T20:15:32.297",
  "references": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4486/"
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.