Stored Cross-Site Scripting in Multiple WSO2 Products

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application.

The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.

Üreticinin çözüm notu (İngilizce)

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4500/#solution

Etkilenen sürümler2 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• security.docs.wso2.com/…ements/security-advisories/2026/WSO2-2025-4500 Üretici bülteni

Kayıt geçmişi

1. 2 Kas 2026 13:23Yayımlandı

İlgili açıklar

• 4,9 CVE-2024-9517Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorized Access to Blocked Accounts
• 5,4 CVE-2024-2372Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
• 8,7 CVE-2026-2613WSO2 API Manager ve ilişkili ürünlerde Admin REST API üzerinden SQL enjeksiyonu
• 4,4 CVE-2026-18800Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
• 4,6 CVE-2024-7075Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
• 4,8 CVE-2024-5617Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks