WSO2 Products Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in multiple WSO2 products. This issue arises from inadequate input validation, allowing user-supplied data to be directly included in server responses from vulnerable service endpoints without proper sanitization or encoding. As a result, an attacker could inject malicious JavaScript. Exploitation of this vulnerability could lead to manipulation of the user interface, redirection to malicious websites, or unauthorized data exfiltration from the browser. Although session-related sensitive cookies are safeguarded with the httpOnly flag to reduce session hijacking risks, the vulnerability's impact may differ based on gateway-level service restrictions.

Impact

Exploitation allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.