Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor
A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section.
To exploit this vulnerability, a malicious actor must have a valid user account with administrative access to the Management Console. If successful, the actor could inject persistent JavaScript payloads, enabling the theft of user data or execution of unauthorized actions on behalf of other users.
While this issue enables persistent client-side script execution, session-related cookies remain protected with the httpOnly flag, preventing session hijacking.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WSO2 Enterprise Integrator
Vendor
WSO2
Product
WSO2 Enterprise Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Integrator · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
6.6.0
Unavailable
None listed
6.6.0
affected
custom
6.6.0.202
Unavailable
None listed
WSO2 API Manager
Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
3.1.0
Unavailable
None listed
3.1.0
affected
custom
3.1.0.275
Unavailable
None listed
3.2.0
affected
custom
3.2.0.392
Unavailable
None listed
3.2.1
affected
custom
3.2.1.19
Unavailable
None listed
4.0.0
affected
custom
4.0.0.308
Unavailable
None listed
4.1.0
affected
custom
4.1.0.171
Unavailable
None listed
4.2.0
affected
custom
4.2.0.107
Unavailable
None listed
4.3.0
affected
custom
4.3.0.21
Unavailable
None listed
WSO2 Open Banking AM
Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
2.0.0
Unavailable
None listed
2.0.0
affected
custom
2.0.0.325
Unavailable
None listed
WSO2 Open Banking IAM
Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
2.0.0
Unavailable
None listed
2.0.0
affected
custom
2.0.0.345
Unavailable
None listed
WSO2 Identity Server as Key Manager
Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
5.10.0
Unavailable
None listed
5.10.0
affected
custom
5.10.0.292
Unavailable
None listed
WSO2 Identity Server
Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts