CVE-2025-6623
Received Received - Intake

Stored XSS in Carbon Console

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WSO2 LLC

Description
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2025-6623
EUVD
EUVD-2025-211115

Affected Vendors & Products

Showing 24 associated CPEs
Vendor Product Version / Range
WSO2 WSO2 API Manager 3.2.0
WSO2 WSO2 API Manager 3.2.1
WSO2 WSO2 API Manager 4.1.0
WSO2 WSO2 API Manager 4.2.0
WSO2 WSO2 API Manager 4.3.0
WSO2 WSO2 API Manager 4.4.0
WSO2 WSO2 API Manager 4.5.0
WSO2 WSO2 Universal Gateway 4.5.0
WSO2 WSO2 Traffic Manager 4.5.0
WSO2 WSO2 API Control Plane 4.5.0
WSO2 WSO2 Carbon Event Publisher UI 5.2.26
WSO2 WSO2 Carbon Event Publisher UI 5.2.41
WSO2 WSO2 Carbon Event Publisher UI 5.2.57
WSO2 WSO2 Carbon Event Publisher UI 5.3.5
WSO2 WSO2 Carbon Event Publisher UI 5.3.11
WSO2 WSO2 Carbon Event Publisher UI 5.3.15
WSO2 WSO2 Carbon Event Publisher UI 5.3.20
WSO2 WSO2 Carbon Event Receiver UI 5.2.26
WSO2 WSO2 Carbon Event Receiver UI 5.2.41
WSO2 WSO2 Carbon Event Receiver UI 5.2.57
WSO2 WSO2 Carbon Event Receiver UI 5.3.5
WSO2 WSO2 Carbon Event Receiver UI 5.3.11
WSO2 WSO2 Carbon Event Receiver UI 5.3.15
WSO2 WSO2 Carbon Event Receiver UI 5.3.20

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross Site Scripting (XSS) vulnerability where the carbon console accepts user-supplied XML input without proper encoding. Attackers can inject malicious scripts that execute in a victim's browser when the page is viewed.

Detection Guidance

To detect this vulnerability, inspect WSO2 product logs for unusual XML input patterns or script execution attempts in the carbon console. Check for user-supplied XML payloads containing JavaScript or HTML tags. Review network traffic for requests to suspicious domains or unexpected UI modifications.

Impact Analysis

An attacker could redirect you to a malicious website, modify the web page's user interface, or steal data. Session hijacking is not possible due to protected cookies.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling malicious script execution in user browsers. Attackers could manipulate web interfaces or steal data, potentially violating confidentiality requirements under these regulations. Session hijacking is prevented but data theft remains a risk.

Mitigation Strategies

Immediately update affected WSO2 products to the fixed versions as specified by WSO2. Apply the GitHub pull request fix for user XML input validation. Disable or restrict access to the carbon console until patches are applied. Monitor for signs of exploitation such as unexpected script execution or UI changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-6623. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart