WSO2 Products Reflected Cross-Site Scripting Vulnerability in JDBC User Store Connection Validation

A reflected cross-site scripting vulnerability has been identified in multiple WSO2 products. This issue arises from inadequate output encoding in error messages produced by the JDBC user store connection validation request. A malicious actor could inject a specially crafted payload, leading the browser to execute arbitrary JavaScript within the context of the affected page. Potential consequences include manipulation of the user interface, redirection to harmful websites, or unauthorized data extraction from the browser. However, session hijacking is not a risk, as all sensitive session cookies are secured with the httpOnly flag.

Impact

Exploitation of this vulnerability could result in reflected cross-site scripting, allowing for the execution of malicious scripts in the user's browser.