XML Injection Vulnerability in WSO2 Carbon Console
CVE-2025-6623

4.3MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Universal Gateway
Wso2 Traffic Manager
Wso2 Api Control Plane
Vendor
CVE Published:
19 October 2026

What is CVE-2025-6623?

The WSO2 Carbon Console contains a vulnerability where it accepts user-supplied XML input without proper encoding for potentially executable content. This flaw can enable a remote attacker to inject malicious scripts, thereby executing arbitrary JavaScript in the victim's browser. Such exploitation may lead to redirection of the user to harmful websites or modifications to the web page interface. It is important to note that session hijacking is not feasible in this case, as the sensitive session cookies are safeguarded by the httpOnly flag.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.12

WSO2 API Manager 3.2.0 < 3.2.0.433

WSO2 API Manager 3.2.1 < 3.2.1.53

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory
https://github.com/wso2/carbon-analytics-common/pull/870
patch

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.