CVE-2026-2445

Summary

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads.

An attacker can leverage this vulnerability to cause the user's browser to redirect to a malicious website, modify the user interface of the webpage, or retrieve sensitive information from the browser. However, the impact is mitigated for session hijacking as all session-related sensitive cookies are protected by the httpOnly flag.

Affected Software

VendorProductVersion RangeStatus
WSO2WSO2 API Manager4.2.0 < 4.2.0.195affected
WSO2WSO2 API Manager4.3.0 < 4.3.0.106affected
WSO2WSO2 API Manager4.4.0 < 4.4.0.70affected
WSO2WSO2 API Manager4.5.0 < 4.5.0.55affected
WSO2WSO2 API Manager4.6.0 < 4.6.0.19affected
WSO2WSO2 API Control Plane4.5.0 < 4.5.0.56affected
WSO2WSO2 API Control Plane4.6.0 < 4.6.0.20affected
WSO2WSO2 Identity Server6.0.0 < 6.0.0.263affected
WSO2WSO2 Identity Server6.1.0 < 6.1.0.266affected
WSO2WSO2 Identity Server7.0.0 < 7.0.0.144affected
WSO2WSO2 Identity Server7.1.0 < 7.1.0.53affected
WSO2WSO2 Identity Server7.2.0 < 7.2.0.12affected

Weaknesses

  • CWE-79: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References