Cross-Site Scripting Vulnerability in WSO2 Management Console
CVE-2024-7075

4.6MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Enterprise Integrator
Wso2 Api Manager
Wso2 Identity Server
Wso2 Carbon User Management Ui
Vendor
CVE Published:
2 November 2026

What is CVE-2024-7075?

The WSO2 Management Console's user search function inadequately encodes user-supplied input before displaying it in the browser. This oversight enables attackers to inject malicious scripts that execute within the user's browser, potentially allowing them to redirect users to harmful sites, alter the web interface, or extract sensitive data. Despite this, the utilization of the httpOnly flag on critical session cookies mitigates risks associated with session hijacking.

Affected Version(s)

WSO2 API Manager 3.2.0 < 3.2.0.388

WSO2 API Manager 3.2.1 < 3.2.1.31

WSO2 API Manager 4.0.0 < 4.0.0.325

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

CyberMavi
.