Cross-Site Scripting Vulnerability in WSO2 Product

CVE-2024-10242

What is CVE-2024-10242?

The vulnerability arises from inadequate validation of user-supplied input at the authentication endpoint in WSO2 API Manager. This oversight allows attackers to inject malicious scripts into the input parameters, which are then executed in the context of the victim's browser. Although the exploit can enable a broad range of attacks, including redirecting users to malicious sites or altering web page appearances, the risk is somewhat mitigated by the protection offered by the httpOnly flag on sensitive session cookies, which helps prevent session hijacking.

References