WSO2 API Manager Reflected Cross-Site Scripting Vulnerability in Authentication Endpoint

A reflected cross-site scripting vulnerability has been identified in the authentication endpoint of WSO2 API Manager versions 4.0.0 and 3.2.0. The vulnerability arises from inadequate validation of user-supplied input, allowing attackers to inject malicious scripts that are executed in the context of the victim's browser. Exploitation of this vulnerability could lead to redirection to malicious websites, modification of the web page's user interface, or unauthorized access to browser-stored information. However, the impact is somewhat mitigated as session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser. This could lead to redirection to malicious sites, UI manipulation, or access to browser-stored information. However, session-related cookies are protected by the httpOnly flag, preventing session hijacking.

Remediation

WSO2 API Manager users should update to version 4.0.0 (update level 318) or 3.2.0 (update level 401).