CVE-2024-4867
Cross-Site Scripting in WSO2 API Manager Developer Portal
Publication date: 2026-04-16
Last updated on: 2026-04-23
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | api_manager | From 3.2.0 (inc) to 3.2.0.408 (exc) |
| wso2 | api_manager | From 3.2.1 (inc) to 3.2.1.32 (exc) |
| wso2 | api_manager | From 4.0.0 (inc) to 4.0.0.293 (exc) |
| wso2 | api_manager | From 4.1.0 (inc) to 4.1.0.187 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the WSO2 API Manager developer portal, where it accepts user-supplied input without proper validation or output encoding.
Because of this, a malicious actor can inject script content that executes within the context of a user's browser, leading to a cross-site scripting (XSS) attack.
How can this vulnerability impact me? :
By exploiting this cross-site scripting vulnerability, an attacker can cause the victim's browser to redirect to malicious websites, alter the user interface of the web page, or retrieve information from the browser.
However, session hijacking is not possible because session-related sensitive cookies are protected by the httpOnly flag.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows a malicious actor to inject and execute script content within a user's browser, potentially leading to unauthorized access to information displayed or processed in the browser.
Such cross-site scripting (XSS) vulnerabilities can increase the risk of data exposure or manipulation, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding personal and sensitive information.
However, session hijacking is mitigated by the use of the httpOnly flag on session cookies, which reduces some risk of unauthorized session access.
Overall, the presence of this vulnerability could lead to non-compliance if exploited to access or manipulate protected data, as it undermines the integrity and confidentiality requirements mandated by such standards.