Search
Find a vulnerability
Search criteria
4 vulnerabilities found for WSO2 Carbon API Gateway by WSO2
CVE-2026-3415 (GCVE-0-2026-3415)
Vulnerability from nvd – Published: 2026-08-06 17:32 – Updated: 2026-08-07 17:47
VLAI
EPSS
VEX
Title
XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
Summary
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:47 UTC
CWE
- CWE-776 - Improper Handling of Special Elements in XML Document Type Declaration (DTD)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.2.0
(custom)
Affected: 3.2.0 , < 3.2.0.472 (custom) Affected: 3.2.1 , < 3.2.1.91 (custom) Affected: 4.1.0 , < 4.1.0.254 (custom) Affected: 4.2.0 , < 4.2.0.194 (custom) Affected: 4.3.0 , < 4.3.0.105 (custom) Affected: 4.4.0 , < 4.4.0.68 (custom) Affected: 4.5.0 , < 4.5.0.53 (custom) Affected: 4.6.0 , < 4.6.0.16 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.53
(custom)
Affected: 4.6.0 , < 4.6.0.16 (custom) |
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.52
(custom)
Affected: 4.6.0 , < 4.6.0.16 (custom) |
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.54
(custom)
Affected: 4.6.0 , < 4.6.0.17 (custom) |
|
| WSO2 | WSO2 Carbon API Gateway |
Affected:
6.7.206 , < 6.7.206.594
(custom)
Affected: 6.7.210 , < 6.7.210.95 (custom) Affected: 9.20.74 , < 9.20.74.398 (custom) Affected: 9.28.116 , < 9.28.116.412 (custom) Affected: 9.29.120 , < 9.29.120.228 (custom) Affected: 9.30.67 , < 9.30.67.158 (custom) Affected: 9.31.86 , < 9.31.86.147 (custom) Affected: 9.32.147 , < 9.32.147.38 (custom) Unaffected: 9.33.61 , ≤ * (custom) |
|
| WSO2 | WSO2 Carbon API Management Implementation |
Affected:
6.7.206 , < 6.7.206.594
(custom)
Affected: 6.7.210 , < 6.7.210.95 (custom) Affected: 9.20.74 , < 9.20.74.398 (custom) Affected: 9.28.116 , < 9.28.116.412 (custom) Affected: 9.29.120 , < 9.29.120.228 (custom) Affected: 9.30.67 , < 9.30.67.158 (custom) Affected: 9.31.86 , < 9.31.86.147 (custom) Affected: 9.32.147 , < 9.32.147.38 (custom) Unaffected: 9.33.61 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3415",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:47:29.495909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:47:46.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.2.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.472",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.91",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.254",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.194",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.105",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.68",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.53",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.16",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.53",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.16",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.52",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.16",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.54",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.17",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.gateway",
"product": "WSO2 Carbon API Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.7.206.594",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.210.95",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "9.20.74.398",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.412",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.228",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.158",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.147",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThan": "9.32.147.38",
"status": "affected",
"version": "9.32.147",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.33.61",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl",
"product": "WSO2 Carbon API Management Implementation",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.7.206.594",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.210.95",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "9.20.74.398",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.412",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.228",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.158",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.147",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThan": "9.32.147.38",
"status": "affected",
"version": "9.32.147",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.33.61",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.472",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.91",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.254",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.194",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.105",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.68",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.53",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.16",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.53",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.16",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.52",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.16",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.54",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.17",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.206.594",
"versionStartIncluding": "6.7.206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.210.95",
"versionStartIncluding": "6.7.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.398",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.412",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.228",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.158",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.147",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.32.147.38",
"versionStartIncluding": "9.32.147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.33.61",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.206.594",
"versionStartIncluding": "6.7.206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.210.95",
"versionStartIncluding": "6.7.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.398",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.412",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.228",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.158",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.147",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.32.147.38",
"versionStartIncluding": "9.32.147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.33.61",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.\n\nSuccessful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product."
}
],
"value": "The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.\n\nSuccessful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product."
}
],
"impacts": [
{
"capecId": "CAPEC-106",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-106 CAPEC-106: XML External Entity Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-776",
"description": "CWE-776: Improper Handling of Special Elements in XML Document Type Declaration (DTD)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:32:10.722Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution"
}
],
"source": {
"advisory": "WSO2-2026-5001",
"discovery": "INTERNAL"
},
"title": "XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-3415",
"datePublished": "2026-08-06T17:32:10.722Z",
"dateReserved": "2026-03-01T18:48:45.632Z",
"dateUpdated": "2026-08-07T17:47:46.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-8154 (GCVE-0-2025-8154)
Vulnerability from nvd – Published: 2026-05-11 09:30 – Updated: 2026-05-11 12:43
VLAI
EPSS
VEX
Title
HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
Summary
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.
By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 12:43 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 4.1.0
(custom)
Affected: 4.1.0 , < 4.1.0.218 (custom) Affected: 4.2.0 , < 4.2.0.164 (custom) Affected: 4.3.0 , < 4.3.0.74 (custom) Affected: 4.4.0 , < 4.4.0.38 (custom) Affected: 4.5.0 , < 4.5.0.20 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.19
(custom)
|
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.19
(custom)
|
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.21
(custom)
|
|
| WSO2 | WSO2 Carbon API Gateway |
Affected:
9.20.74 , < 9.20.74.374
(custom)
Affected: 9.28.116 , < 9.28.116.363 (custom) Affected: 9.29.120 , < 9.29.120.181 (custom) Affected: 9.30.67 , < 9.30.67.104 (custom) Affected: 9.31.86 , < 9.31.86.64 (custom) Unaffected: 9.32.2 , ≤ * (custom) |
|
| WSO2 | WSO2 Carbon API Management Implementation |
Affected:
9.20.74 , < 9.20.74.374
(custom)
Affected: 9.28.116 , < 9.28.116.363 (custom) Affected: 9.29.120 , < 9.29.120.181 (custom) Affected: 9.30.67 , < 9.30.67.104 (custom) Affected: 9.31.86 , < 9.31.86.64 (custom) Unaffected: 9.32.2 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T12:43:38.026738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T12:43:47.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.218",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.164",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.74",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.38",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.20",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.19",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.19",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.21",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.gateway",
"product": "WSO2 Carbon API Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "9.20.74.374",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.363",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.181",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.104",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.64",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl",
"product": "WSO2 Carbon API Management Implementation",
"vendor": "WSO2",
"versions": [
{
"lessThan": "9.20.74.374",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.363",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.181",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.104",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.64",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.218",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.164",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.74",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.38",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.20",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.19",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.19",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.21",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.374",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.363",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.181",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.104",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.64",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.32.2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.374",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.363",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.181",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.104",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.64",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.32.2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities."
}
],
"value": "In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 CAPEC-118: HTTP Response Splitting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T09:43:39.282Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4410",
"discovery": "INTERNAL"
},
"title": "HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-8154",
"datePublished": "2026-05-11T09:30:36.027Z",
"dateReserved": "2025-07-25T06:42:23.104Z",
"dateUpdated": "2026-05-11T12:43:47.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-3415 (GCVE-0-2026-3415)
Vulnerability from cvelistv5 – Published: 2026-08-06 17:32 – Updated: 2026-08-07 17:47
VLAI
EPSS
VEX
Title
XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
Summary
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.
Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:47 UTC
CWE
- CWE-776 - Improper Handling of Special Elements in XML Document Type Declaration (DTD)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.2.0
(custom)
Affected: 3.2.0 , < 3.2.0.472 (custom) Affected: 3.2.1 , < 3.2.1.91 (custom) Affected: 4.1.0 , < 4.1.0.254 (custom) Affected: 4.2.0 , < 4.2.0.194 (custom) Affected: 4.3.0 , < 4.3.0.105 (custom) Affected: 4.4.0 , < 4.4.0.68 (custom) Affected: 4.5.0 , < 4.5.0.53 (custom) Affected: 4.6.0 , < 4.6.0.16 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.53
(custom)
Affected: 4.6.0 , < 4.6.0.16 (custom) |
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.52
(custom)
Affected: 4.6.0 , < 4.6.0.16 (custom) |
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.54
(custom)
Affected: 4.6.0 , < 4.6.0.17 (custom) |
|
| WSO2 | WSO2 Carbon API Gateway |
Affected:
6.7.206 , < 6.7.206.594
(custom)
Affected: 6.7.210 , < 6.7.210.95 (custom) Affected: 9.20.74 , < 9.20.74.398 (custom) Affected: 9.28.116 , < 9.28.116.412 (custom) Affected: 9.29.120 , < 9.29.120.228 (custom) Affected: 9.30.67 , < 9.30.67.158 (custom) Affected: 9.31.86 , < 9.31.86.147 (custom) Affected: 9.32.147 , < 9.32.147.38 (custom) Unaffected: 9.33.61 , ≤ * (custom) |
|
| WSO2 | WSO2 Carbon API Management Implementation |
Affected:
6.7.206 , < 6.7.206.594
(custom)
Affected: 6.7.210 , < 6.7.210.95 (custom) Affected: 9.20.74 , < 9.20.74.398 (custom) Affected: 9.28.116 , < 9.28.116.412 (custom) Affected: 9.29.120 , < 9.29.120.228 (custom) Affected: 9.30.67 , < 9.30.67.158 (custom) Affected: 9.31.86 , < 9.31.86.147 (custom) Affected: 9.32.147 , < 9.32.147.38 (custom) Unaffected: 9.33.61 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-3415",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:47:29.495909Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:47:46.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.2.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.472",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.91",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.254",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.194",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.105",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.68",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.53",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.16",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.53",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.16",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.52",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.16",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.54",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
},
{
"lessThan": "4.6.0.17",
"status": "affected",
"version": "4.6.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.gateway",
"product": "WSO2 Carbon API Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.7.206.594",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.210.95",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "9.20.74.398",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.412",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.228",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.158",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.147",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThan": "9.32.147.38",
"status": "affected",
"version": "9.32.147",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.33.61",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl",
"product": "WSO2 Carbon API Management Implementation",
"vendor": "WSO2",
"versions": [
{
"lessThan": "6.7.206.594",
"status": "affected",
"version": "6.7.206",
"versionType": "custom"
},
{
"lessThan": "6.7.210.95",
"status": "affected",
"version": "6.7.210",
"versionType": "custom"
},
{
"lessThan": "9.20.74.398",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.412",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.228",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.158",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.147",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThan": "9.32.147.38",
"status": "affected",
"version": "9.32.147",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.33.61",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.472",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.91",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.254",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.194",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.105",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.68",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.53",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.16",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.53",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.16",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.52",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.16",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.54",
"versionStartIncluding": "4.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.6.0.17",
"versionStartIncluding": "4.6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.206.594",
"versionStartIncluding": "6.7.206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.210.95",
"versionStartIncluding": "6.7.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.398",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.412",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.228",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.158",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.147",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.32.147.38",
"versionStartIncluding": "9.32.147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.33.61",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.206.594",
"versionStartIncluding": "6.7.206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.7.210.95",
"versionStartIncluding": "6.7.210",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.398",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.412",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.228",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.158",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.147",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.32.147.38",
"versionStartIncluding": "9.32.147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.33.61",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.\n\nSuccessful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product."
}
],
"value": "The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges.\n\nSuccessful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product."
}
],
"impacts": [
{
"capecId": "CAPEC-106",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-106 CAPEC-106: XML External Entity Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-776",
"description": "CWE-776: Improper Handling of Special Elements in XML Document Type Declaration (DTD)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T17:32:10.722Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2026-5001/#solution"
}
],
"source": {
"advisory": "WSO2-2026-5001",
"discovery": "INTERNAL"
},
"title": "XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2026-3415",
"datePublished": "2026-08-06T17:32:10.722Z",
"dateReserved": "2026-03-01T18:48:45.632Z",
"dateUpdated": "2026-08-07T17:47:46.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-8154 (GCVE-0-2025-8154)
Vulnerability from cvelistv5 – Published: 2026-05-11 09:30 – Updated: 2026-05-11 12:43
VLAI
EPSS
VEX
Title
HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
Summary
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.
By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 12:43 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 4.1.0
(custom)
Affected: 4.1.0 , < 4.1.0.218 (custom) Affected: 4.2.0 , < 4.2.0.164 (custom) Affected: 4.3.0 , < 4.3.0.74 (custom) Affected: 4.4.0 , < 4.4.0.38 (custom) Affected: 4.5.0 , < 4.5.0.20 (custom) |
|
| WSO2 | WSO2 Universal Gateway |
Affected:
4.5.0 , < 4.5.0.19
(custom)
|
|
| WSO2 | WSO2 Traffic Manager |
Affected:
4.5.0 , < 4.5.0.19
(custom)
|
|
| WSO2 | WSO2 API Control Plane |
Affected:
4.5.0 , < 4.5.0.21
(custom)
|
|
| WSO2 | WSO2 Carbon API Gateway |
Affected:
9.20.74 , < 9.20.74.374
(custom)
Affected: 9.28.116 , < 9.28.116.363 (custom) Affected: 9.29.120 , < 9.29.120.181 (custom) Affected: 9.30.67 , < 9.30.67.104 (custom) Affected: 9.31.86 , < 9.31.86.64 (custom) Unaffected: 9.32.2 , ≤ * (custom) |
|
| WSO2 | WSO2 Carbon API Management Implementation |
Affected:
9.20.74 , < 9.20.74.374
(custom)
Affected: 9.28.116 , < 9.28.116.363 (custom) Affected: 9.29.120 , < 9.29.120.181 (custom) Affected: 9.30.67 , < 9.30.67.104 (custom) Affected: 9.31.86 , < 9.31.86.64 (custom) Unaffected: 9.32.2 , ≤ * (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-8154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T12:43:38.026738Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T12:43:47.037Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.1.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.1.0.218",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.164",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.74",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.38",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.20",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.19",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.19",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0.21",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.gateway",
"product": "WSO2 Carbon API Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "9.20.74.374",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.363",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.181",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.104",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.64",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.2",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.impl",
"product": "WSO2 Carbon API Management Implementation",
"vendor": "WSO2",
"versions": [
{
"lessThan": "9.20.74.374",
"status": "affected",
"version": "9.20.74",
"versionType": "custom"
},
{
"lessThan": "9.28.116.363",
"status": "affected",
"version": "9.28.116",
"versionType": "custom"
},
{
"lessThan": "9.29.120.181",
"status": "affected",
"version": "9.29.120",
"versionType": "custom"
},
{
"lessThan": "9.30.67.104",
"status": "affected",
"version": "9.30.67",
"versionType": "custom"
},
{
"lessThan": "9.31.86.64",
"status": "affected",
"version": "9.31.86",
"versionType": "custom"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "9.32.2",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.218",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.164",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.74",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.38",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.20",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.19",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.19",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.21",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.374",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.363",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.181",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.104",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.64",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.32.2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.20.74.374",
"versionStartIncluding": "9.20.74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.28.116.363",
"versionStartIncluding": "9.28.116",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.29.120.181",
"versionStartIncluding": "9.29.120",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.30.67.104",
"versionStartIncluding": "9.30.67",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndExcluding": "9.31.86.64",
"versionStartIncluding": "9.31.86",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_api_management_implementation:*:*:*:*:*:*:*:*",
"versionEndIncluding": "*",
"versionStartIncluding": "9.32.2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities."
}
],
"value": "In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses.\n\nBy exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 CAPEC-118: HTTP Response Splitting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T09:43:39.282Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4410",
"discovery": "INTERNAL"
},
"title": "HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-8154",
"datePublished": "2026-05-11T09:30:36.027Z",
"dateReserved": "2025-07-25T06:42:23.104Z",
"dateUpdated": "2026-05-11T12:43:47.037Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}