CVE-2025-6623
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
- Score
- CVSS 3.1 4.3 Medium
- Status
- Awaiting Analysis - ed10eef1-636d-4fbe-9993-6890dfa878f8
- Published
- 2026-10-19
- Last modified
- 2026-10-20
- Weaknesses
- CWE-79
Affected products
- Wso2 Api Control Plane (Wso2)
- Wso2 Api Manager (Wso2)
- Wso2 Carbon Event Publisher Ui (Wso2)
- Wso2 Carbon Event Receiver Ui (Wso2)
- Wso2 Traffic Manager (Wso2)
- Wso2 Universal Gateway (Wso2)
References
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/
- https://github.com/wso2/carbon-analytics-common/pull/870
