{"id":"CVE-2025-8154","title":"In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a…","summary":"In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-74"],"vendor":"wso2","product":"api_control_plane","affected":["api_control_plane >= 4.5.0, < 4.5.0.21","api_manager >= 4.1.0, < 4.1.0.218","api_manager >= 4.2.0, < 4.2.0.164","api_manager >= 4.3.0, < 4.3.0.74","api_manager >= 4.4.0, < 4.4.0.38","api_manager >= 4.5.0, < 4.5.0.20","traffic_manager >= 4.5.0, < 4.5.0.19","universal_gateway >= 4.5.0, < 4.5.0.19"],"patched":["api_control_plane 4.5.0.21","api_manager 4.5.0.20","traffic_manager 4.5.0.19","universal_gateway 4.5.0.19"],"published":"2026-05-11","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-8154","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/","label":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"tags":["nvd"],"epss":0.00186,"epssPercentile":0.07581,"ingestedAt":"2026-10-14T13:30:58.493Z","slug":"CVE-2025-8154","body":"## Overview\n\nIn Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.\n\n## Affected\n\n- `api_control_plane >= 4.5.0, < 4.5.0.21`\n- `api_manager >= 4.1.0, < 4.1.0.218`\n- `api_manager >= 4.2.0, < 4.2.0.164`\n- `api_manager >= 4.3.0, < 4.3.0.74`\n- `api_manager >= 4.4.0, < 4.4.0.38`\n- `api_manager >= 4.5.0, < 4.5.0.20`\n- `traffic_manager >= 4.5.0, < 4.5.0.19`\n- `universal_gateway >= 4.5.0, < 4.5.0.19`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `api_control_plane 4.5.0.21`\n- `api_manager 4.5.0.20`\n- `traffic_manager 4.5.0.19`\n- `universal_gateway 4.5.0.19`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}