XSS in Wso2 API Manager
CVE-2025-6024
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (12.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 12th percentile — 12.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Wso2 API Manager — versions 3.1.0, 3.2.0, 3.2.1
- Wso2 Identity Server — versions 5.10.0, 5.11.0
- Wso2 API Manager — versions 0, 3.1.0, 3.2.0
- Wso2 Identity Server — versions 0, 5.10.0, 5.11.0
Weakness classification (CWE)
References
- ed10eef1-636d-4fbe-9993-6890dfa878f8 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-6024?
- CVE-2025-6024 is a medium-severity vulnerability in Wso2 API Manager, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2026-04-16.
- How severe is CVE-2025-6024?
- Medium severity. CVSS v3 base score is 6.1 out of 10.