CVE-2025-4760
Description
An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.
How to fix
- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api9.31.117 or later
- org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v19.31.117 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wso2 api_control_plane | 4.5.0 | — |
| wso2 api_manager | 3.2.0, 3.2.1, 4.1.0, 4.2.0, 4.3.0, 4.4.0, 4.5.0 | — |
| wso2 traffic_manager | 4.5.0 | — |
| wso2 universal_gateway | 4.5.0 | — |
| org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.apiMaven | v < 9.31.117 | 9.31.117 |
| org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1Maven | v < 9.31.117 | 9.31.117 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.