HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.
By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WSO2 API Manager
Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
4.1.0
Unavailable
None listed
4.1.0
affected
custom
4.1.0.218
Unavailable
None listed
4.2.0
affected
custom
4.2.0.164
Unavailable
None listed
4.3.0
affected
custom
4.3.0.74
Unavailable
None listed
4.4.0
affected
custom
4.4.0.38
Unavailable
None listed
4.5.0
affected
custom
4.5.0.20
Unavailable
None listed
WSO2 Universal Gateway
Vendor
WSO2
Product
WSO2 Universal Gateway
Platforms
Unknown
Default status
unaffected
WSO2 Universal Gateway · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.5.0
affected
custom
4.5.0.19
Unavailable
None listed
WSO2 Traffic Manager
Vendor
WSO2
Product
WSO2 Traffic Manager
Platforms
Unknown
Default status
unaffected
WSO2 Traffic Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.5.0
affected
custom
4.5.0.19
Unavailable
None listed
WSO2 API Control Plane
Vendor
WSO2
Product
WSO2 API Control Plane
Platforms
Unknown
Default status
unaffected
WSO2 API Control Plane · Scoped product and version facts