CVE-2025-6623

Awaiting Analysis Awaiting Analysis - Queue

Stored XSS in Carbon Console

Publication date: 2026-10-19

Last updated on: 2026-11-04

Assigner: WSO2 LLC

Description

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-11-04

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2025-6623

EUVD

EUVD-2025-211115

Affected Vendors & Products

Vendor	Product	Version / Range
WSO2	WSO2 API Manager	3.2.0
WSO2	WSO2 API Manager	3.2.1
WSO2	WSO2 API Manager	4.1.0
WSO2	WSO2 API Manager	4.2.0
WSO2	WSO2 API Manager	4.3.0
WSO2	WSO2 API Manager	4.4.0
WSO2	WSO2 API Manager	4.5.0
WSO2	WSO2 Universal Gateway	4.5.0
WSO2	WSO2 Traffic Manager	4.5.0
WSO2	WSO2 API Control Plane	4.5.0
WSO2	WSO2 Carbon Event Publisher UI	5.2.26
WSO2	WSO2 Carbon Event Publisher UI	5.2.41
WSO2	WSO2 Carbon Event Publisher UI	5.2.57
WSO2	WSO2 Carbon Event Publisher UI	5.3.5
WSO2	WSO2 Carbon Event Publisher UI	5.3.11
WSO2	WSO2 Carbon Event Publisher UI	5.3.15
WSO2	WSO2 Carbon Event Publisher UI	5.3.20
WSO2	WSO2 Carbon Event Receiver UI	5.2.26
WSO2	WSO2 Carbon Event Receiver UI	5.2.41
WSO2	WSO2 Carbon Event Receiver UI	5.2.57
WSO2	WSO2 Carbon Event Receiver UI	5.3.5
WSO2	WSO2 Carbon Event Receiver UI	5.3.11
WSO2	WSO2 Carbon Event Receiver UI	5.3.15
WSO2	WSO2 Carbon Event Receiver UI	5.3.20

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Stored Cross Site Scripting (XSS) vulnerability where the carbon console accepts user-supplied XML input without proper encoding. Attackers can inject malicious scripts that execute in a victim's browser when the page is viewed.

Detection Guidance

To detect this vulnerability, inspect WSO2 product logs for unusual XML input patterns or script execution attempts in the carbon console. Check for user-supplied XML payloads containing JavaScript or HTML tags. Review network traffic for requests to suspicious domains or unexpected UI modifications.

Impact Analysis

An attacker could redirect you to a malicious website, modify the web page's user interface, or steal data. Session hijacking is not possible due to protected cookies.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling malicious script execution in user browsers. Attackers could manipulate web interfaces or steal data, potentially violating confidentiality requirements under these regulations. Session hijacking is prevented but data theft remains a risk.

Mitigation Strategies

Immediately update affected WSO2 products to the fixed versions as specified by WSO2. Apply the GitHub pull request fix for user XML input validation. Disable or restrict access to the carbon console until patches are applied. Monitor for signs of exploitation such as unexpected script execution or UI changes.

Hi! I’m here to help you understand CVE-2025-6623. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...