CVE-2025-5769
Description
The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting this vulnerability, an attacker can redirect the user's browser to a malicious website, modify the content of the web page displayed to the user, or exfiltrate information from the browser. However, due to the implementation of the httpOnly flag on session-related sensitive cookies, session hijacking and similar attacks are not possible.
How to fix
- WSO2 WSO2 API Control Plane4.5.0.11 or later
- WSO2 WSO2 API Manager3.2.0.430, 3.2.1.50, 4.1.0.212, 4.2.0.150, 4.3.0.63, 4.4.0.26, 4.5.0.10 or later
- WSO2 WSO2 Identity Server5.10.0.359, 5.11.0.404, 6.0.0.237, 6.1.0.234, 7.0.0.107, 7.1.0.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 API Control Plane | 4.5.0 ≤ v < 4.5.0.11 | 4.5.0.11 |
| WSO2 WSO2 API Manager | 3.2.0 ≤ v < 3.2.0.430, 3.2.1 ≤ v < 3.2.1.50, 4.1.0 ≤ v < 4.1.0.212, 4.2.0 ≤ v < 4.2.0.150, 4.3.0 ≤ v < 4.3.0.63, 4.4.0 ≤ v < 4.4.0.26, 4.5.0 ≤ v < 4.5.0.10 | 3.2.0.430, 3.2.1.50, 4.1.0.212, 4.2.0.150, 4.3.0.63, 4.4.0.26, 4.5.0.10 |
| WSO2 WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.359, 5.11.0 ≤ v < 5.11.0.404, 6.0.0 ≤ v < 6.0.0.237, 6.1.0 ≤ v < 6.1.0.234, 7.0.0 ≤ v < 7.0.0.107, 7.1.0 ≤ v < 7.1.0.12 | 5.10.0.359, 5.11.0.404, 6.0.0.237, 6.1.0.234, 7.0.0.107, 7.1.0.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.