CVE-2024-4867
Description
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser. By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag.
How to fix
- wso2 api_manager3.2.0.408, 3.2.1.32, 4.0.0.293, 4.1.0.187 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wso2 api_manager | 3.2.0 ≤ v < 3.2.0.408, 3.2.1 ≤ v < 3.2.1.32, 4.0.0 ≤ v < 4.0.0.293, 4.1.0 ≤ v < 4.1.0.187 | 3.2.0.408, 3.2.1.32, 4.0.0.293, 4.1.0.187 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.