Search
Find a vulnerability
Search criteria
2 vulnerabilities found for WSO2 Carbon Event Publisher UI by WSO2
CVE-2025-6623 (GCVE-0-2025-6623)
Vulnerability from nvd – Published: 2026-10-19 16:25 – Updated: 2026-10-19 16:25
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
Summary
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Severity
4.3 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
| https://github.com/wso2/carbon-analytics-common/p… | patch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.2.0
(custom)
Affected: 3.2.0 , < 3.2.0.433 (custom) Affected: 3.2.1 , < 3.2.1.53 (custom) Affected: 4.1.0 , < 4.1.0.215 (custom) Affected: 4.2.0 , < 4.2.0.153 (custom) Affected: 4.3.0 , < 4.3.0.66 (custom) Affected: 4.4.0 , < 4.4.0.29 (custom) Affected: 4.5.0 , < 4.5.0.11 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.11 (custom) cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.11 (custom) cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.12 (custom) cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Event Publisher UI |
Affected:
5.2.26 , < 5.2.26.19
(custom)
Affected: 5.2.41 , < 5.2.41.6 (custom) Affected: 5.2.57 , < 5.2.57.7 (custom) Affected: 5.3.5 , < 5.3.5.4 (custom) Affected: 5.3.11 , < 5.3.11.4 (custom) Affected: 5.3.15 , < 5.3.15.3 (custom) Affected: 5.3.20 , < 5.3.20.1 (custom) cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Event Receiver UI |
Affected:
5.2.26 , < 5.2.26.19
(custom)
Affected: 5.2.41 , < 5.2.41.6 (custom) Affected: 5.2.57 , < 5.2.57.7 (custom) Affected: 5.3.5 , < 5.3.5.4 (custom) Affected: 5.3.11 , < 5.3.11.4 (custom) Affected: 5.3.15 , < 5.3.15.3 (custom) Affected: 5.3.20 , < 5.3.20.1 (custom) cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.2.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.433",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.53",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.215",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.153",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.66",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.29",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.12",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui",
"product": "WSO2 Carbon Event Publisher UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.2.26.19",
"status": "affected",
"version": "5.2.26",
"versionType": "custom"
},
{
"lessThan": "5.2.41.6",
"status": "affected",
"version": "5.2.41",
"versionType": "custom"
},
{
"lessThan": "5.2.57.7",
"status": "affected",
"version": "5.2.57",
"versionType": "custom"
},
{
"lessThan": "5.3.5.4",
"status": "affected",
"version": "5.3.5",
"versionType": "custom"
},
{
"lessThan": "5.3.11.4",
"status": "affected",
"version": "5.3.11",
"versionType": "custom"
},
{
"lessThan": "5.3.15.3",
"status": "affected",
"version": "5.3.15",
"versionType": "custom"
},
{
"lessThan": "5.3.20.1",
"status": "affected",
"version": "5.3.20",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui",
"product": "WSO2 Carbon Event Receiver UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.2.26.19",
"status": "affected",
"version": "5.2.26",
"versionType": "custom"
},
{
"lessThan": "5.2.41.6",
"status": "affected",
"version": "5.2.41",
"versionType": "custom"
},
{
"lessThan": "5.2.57.7",
"status": "affected",
"version": "5.2.57",
"versionType": "custom"
},
{
"lessThan": "5.3.5.4",
"status": "affected",
"version": "5.3.5",
"versionType": "custom"
},
{
"lessThan": "5.3.11.4",
"status": "affected",
"version": "5.3.11",
"versionType": "custom"
},
{
"lessThan": "5.3.15.3",
"status": "affected",
"version": "5.3.15",
"versionType": "custom"
},
{
"lessThan": "5.3.20.1",
"status": "affected",
"version": "5.3.20",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.433",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.53",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.215",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.153",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.66",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.29",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.12",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.26.19",
"versionStartIncluding": "5.2.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.41.6",
"versionStartIncluding": "5.2.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.57.7",
"versionStartIncluding": "5.2.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.5.4",
"versionStartIncluding": "5.3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.11.4",
"versionStartIncluding": "5.3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.15.3",
"versionStartIncluding": "5.3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.20.1",
"versionStartIncluding": "5.3.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.26.19",
"versionStartIncluding": "5.2.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.41.6",
"versionStartIncluding": "5.2.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.57.7",
"versionStartIncluding": "5.2.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.5.4",
"versionStartIncluding": "5.3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.11.4",
"versionStartIncluding": "5.3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.15.3",
"versionStartIncluding": "5.3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.20.1",
"versionStartIncluding": "5.3.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser, leading to actions such as redirecting the user to a malicious website or modifying the web page\u0027s user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag."
}
],
"value": "The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser, leading to actions such as redirecting the user to a malicious website or modifying the web page\u0027s user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag."
}
],
"impacts": [
{
"capecId": "CAPEC-23",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-23 CAPEC-23: Cross-site Scripting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:25:50.419Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-analytics-common/pull/870"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4316",
"discovery": "INTERNAL"
},
"title": "Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-6623",
"datePublished": "2026-10-19T16:25:50.419Z",
"dateReserved": "2025-06-25T07:42:27.717Z",
"dateUpdated": "2026-10-19T16:25:50.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6623 (GCVE-0-2025-6623)
Vulnerability from cvelistv5 – Published: 2026-10-19 16:25 – Updated: 2026-10-19 16:25
VLAI
EPSS
VEX
Title
Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
Summary
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Severity
4.3 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://security.docs.wso2.com/en/latest/security… | vendor-advisory |
| https://github.com/wso2/carbon-analytics-common/p… | patch |
Impacted products
6 products
| Vendor | Product | Version | |
|---|---|---|---|
| WSO2 | WSO2 API Manager |
Unknown:
0 , < 3.2.0
(custom)
Affected: 3.2.0 , < 3.2.0.433 (custom) Affected: 3.2.1 , < 3.2.1.53 (custom) Affected: 4.1.0 , < 4.1.0.215 (custom) Affected: 4.2.0 , < 4.2.0.153 (custom) Affected: 4.3.0 , < 4.3.0.66 (custom) Affected: 4.4.0 , < 4.4.0.29 (custom) Affected: 4.5.0 , < 4.5.0.11 (custom) cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Universal Gateway |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.11 (custom) cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Traffic Manager |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.11 (custom) cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 API Control Plane |
Unknown:
0 , < 4.5.0
(custom)
Affected: 4.5.0 , < 4.5.0.12 (custom) cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Event Publisher UI |
Affected:
5.2.26 , < 5.2.26.19
(custom)
Affected: 5.2.41 , < 5.2.41.6 (custom) Affected: 5.2.57 , < 5.2.57.7 (custom) Affected: 5.3.5 , < 5.3.5.4 (custom) Affected: 5.3.11 , < 5.3.11.4 (custom) Affected: 5.3.15 , < 5.3.15.3 (custom) Affected: 5.3.20 , < 5.3.20.1 (custom) cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:* |
|
| WSO2 | WSO2 Carbon Event Receiver UI |
Affected:
5.2.26 , < 5.2.26.19
(custom)
Affected: 5.2.41 , < 5.2.41.6 (custom) Affected: 5.2.57 , < 5.2.57.7 (custom) Affected: 5.3.5 , < 5.3.5.4 (custom) Affected: 5.3.11 , < 5.3.11.4 (custom) Affected: 5.3.15 , < 5.3.15.3 (custom) Affected: 5.3.20 , < 5.3.20.1 (custom) cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WSO2 API Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "3.2.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "3.2.0.433",
"status": "affected",
"version": "3.2.0",
"versionType": "custom"
},
{
"lessThan": "3.2.1.53",
"status": "affected",
"version": "3.2.1",
"versionType": "custom"
},
{
"lessThan": "4.1.0.215",
"status": "affected",
"version": "4.1.0",
"versionType": "custom"
},
{
"lessThan": "4.2.0.153",
"status": "affected",
"version": "4.2.0",
"versionType": "custom"
},
{
"lessThan": "4.3.0.66",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThan": "4.4.0.29",
"status": "affected",
"version": "4.4.0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Universal Gateway",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 Traffic Manager",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.11",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "WSO2 API Control Plane",
"vendor": "WSO2",
"versions": [
{
"lessThan": "4.5.0",
"status": "unknown",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "4.5.0.12",
"status": "affected",
"version": "4.5.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.publisher.ui",
"product": "WSO2 Carbon Event Publisher UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.2.26.19",
"status": "affected",
"version": "5.2.26",
"versionType": "custom"
},
{
"lessThan": "5.2.41.6",
"status": "affected",
"version": "5.2.41",
"versionType": "custom"
},
{
"lessThan": "5.2.57.7",
"status": "affected",
"version": "5.2.57",
"versionType": "custom"
},
{
"lessThan": "5.3.5.4",
"status": "affected",
"version": "5.3.5",
"versionType": "custom"
},
{
"lessThan": "5.3.11.4",
"status": "affected",
"version": "5.3.11",
"versionType": "custom"
},
{
"lessThan": "5.3.15.3",
"status": "affected",
"version": "5.3.15",
"versionType": "custom"
},
{
"lessThan": "5.3.20.1",
"status": "affected",
"version": "5.3.20",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.ui",
"product": "WSO2 Carbon Event Receiver UI",
"vendor": "WSO2",
"versions": [
{
"lessThan": "5.2.26.19",
"status": "affected",
"version": "5.2.26",
"versionType": "custom"
},
{
"lessThan": "5.2.41.6",
"status": "affected",
"version": "5.2.41",
"versionType": "custom"
},
{
"lessThan": "5.2.57.7",
"status": "affected",
"version": "5.2.57",
"versionType": "custom"
},
{
"lessThan": "5.3.5.4",
"status": "affected",
"version": "5.3.5",
"versionType": "custom"
},
{
"lessThan": "5.3.11.4",
"status": "affected",
"version": "5.3.11",
"versionType": "custom"
},
{
"lessThan": "5.3.15.3",
"status": "affected",
"version": "5.3.15",
"versionType": "custom"
},
{
"lessThan": "5.3.20.1",
"status": "affected",
"version": "5.3.20",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.0.433",
"versionStartIncluding": "3.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.2.1.53",
"versionStartIncluding": "3.2.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.1.0.215",
"versionStartIncluding": "4.1.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.2.0.153",
"versionStartIncluding": "4.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.3.0.66",
"versionStartIncluding": "4.3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.0.29",
"versionStartIncluding": "4.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_universal_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_traffic_manager:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.11",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_api_control_plane:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.5.0.12",
"versionStartIncluding": "4.5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.26.19",
"versionStartIncluding": "5.2.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.41.6",
"versionStartIncluding": "5.2.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.57.7",
"versionStartIncluding": "5.2.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.5.4",
"versionStartIncluding": "5.3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.11.4",
"versionStartIncluding": "5.3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.15.3",
"versionStartIncluding": "5.3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_publisher_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.20.1",
"versionStartIncluding": "5.3.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.26.19",
"versionStartIncluding": "5.2.26",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.41.6",
"versionStartIncluding": "5.2.41",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.2.57.7",
"versionStartIncluding": "5.2.57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.5.4",
"versionStartIncluding": "5.3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.11.4",
"versionStartIncluding": "5.3.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.15.3",
"versionStartIncluding": "5.3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:wso2:wso2_carbon_event_receiver_ui:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.3.20.1",
"versionStartIncluding": "5.3.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser, leading to actions such as redirecting the user to a malicious website or modifying the web page\u0027s user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag."
}
],
"value": "The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim\u0027s browser, leading to actions such as redirecting the user to a malicious website or modifying the web page\u0027s user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag."
}
],
"impacts": [
{
"capecId": "CAPEC-23",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-23 CAPEC-23: Cross-site Scripting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:25:50.419Z",
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/"
},
{
"tags": [
"patch"
],
"url": "https://github.com/wso2/carbon-analytics-common/pull/870"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
}
],
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/#solution"
}
],
"source": {
"advisory": "WSO2-2025-4316",
"discovery": "INTERNAL"
},
"title": "Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"assignerShortName": "WSO2",
"cveId": "CVE-2025-6623",
"datePublished": "2026-10-19T16:25:50.419Z",
"dateReserved": "2025-06-25T07:42:27.717Z",
"dateUpdated": "2026-10-19T16:25:50.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}