Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.6
CVE-2024-7075: WSO2 consoles allow script injection via search
CVE-2024-7075 · published 2 days ago
Summary
The search box in the management console of WSO2 Enterprise Integrator, API Manager, Identity Server, and Carbon User Management UI does not properly clean the text you type, so an attacker could insert malicious code that runs in your browser. This could trick users into visiting harmful sites or reveal information, though the session cookie is protected against theft. Update to the latest released version or apply the vendor's security patch that properly sanitizes search input.
What to do
- Update wso2 wso2 enterprise integrator to version 6.6.0.212 or later.
- Update wso2 wso2 api manager to version 3.2.0.388 or later.
- Update wso2 wso2 identity server to version 5.11.0.364 or later.
- Update wso2 wso2 carbon user management ui to version 5.14.127.12 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wso2 | wso2 enterprise integrator | < 6.6.0.212 |
| wso2 | wso2 api manager | < 3.2.0.388 |
| wso2 | wso2 identity server | < 5.11.0.364 |
| wso2 | wso2 carbon user management ui | < 5.14.127.12 |
Original advisory text
Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console.
Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.
Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published2 Nov 2026
Updated3 Nov 2026
First seen2 Nov 2026
Track software like this
Free during beta