CVE-2024-8008Medium· 5.2▾ SunlitA reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a sp…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 28.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.5%
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.
This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.
enterprise_integrator >= 6.6.0 < 6.6.0.211api_manager >= 3.1.0 < 3.1.0.305api_manager >= 3.2.0 < 3.2.0.396api_manager >= 3.2.1 < 3.2.1.28api_manager >= 4.0.0 < 4.0.0.313api_manager >= 4.1.0 < 4.1.0.182api_manager >= 4.2.0 < 4.2.0.121api_manager >= 4.3.0 < 4.3.0.32api_manager >= 4.4.0 < 4.4.0.1api_manager >= 4.5.0 < 4.5.0.16identity_server_as_key_manager >= 5.10.0 < 5.10.0.321identity_server >= 5.10.0 < 5.10.0.328identity_server >= 5.11.0 < 5.11.0.374identity_server >= 6.0.0 < 6.0.0.216identity_server >= 6.1.0 < 6.1.0.201identity_server >= 7.0.0 < 7.0.0.69open_banking_iam >= 2.0.0 < 2.0.0.374open_banking_am >= 2.0.0 < 2.0.0.354traffic_manager >= 4.5.0 < 4.5.0.16api_control_plane >= 4.5.0 < 4.5.0.17universal_gateway >= 4.5.0 < 4.5.0.16org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.14.127 < 5.14.127.9org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.5 < 5.17.5.289org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.118 < 5.17.118.10org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.187 < 5.18.187.276org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.248 < 5.18.248.22org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.23.8 < 5.23.8.193org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.24.8 < 5.24.8.11org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.92 < 5.25.92.104org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.705 < 5.25.705.10org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.713 < 5.25.713.1org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.724 < 5.25.724.1org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 7.0.78 < 7.0.78.46Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4103Medium· 6.4Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization
CVE-2025-6024Medium· 6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint
CVE-2025-0209Medium· 6.1A reflected cross-site scripting (XSS) vulnerability exists in the account registration flow of WSO2 Identity Server due to improper output encoding
CVE-2025-10503Medium· 6.1The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encoding
CVE-2025-8591Medium· 6.1The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser
CVE-2024-8122Medium· 5.9The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA)