CVE-2024-5139: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WSO2 WSO2 Enterprise Integrator

The Authentication Endpoint in WSO2 Enterprise Integrator improperly neutralizes user-supplied input during web page generation, enabling injection of malicious JavaScript payloads (CWE-79). This vulnerability can be triggered by submitting crafted input to the endpoint, potentially allowing attackers to redirect users to malicious sites, alter the web page interface, or extract sensitive browser information. However, session hijacking is mitigated by the presence of the httpOnly flag on session cookies. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and partial confidentiality and integrity impact without availability impact. Multiple versions across several major releases are affected, with fixed versions indicated by upper bounds in the affectedVersions list.

Successful exploitation can lead to redirection of users to malicious websites, modification of the web page's user interface, and extraction of sensitive information from the browser. Session hijacking is not possible due to the httpOnly flag on session cookies, limiting the impact to information disclosure and UI manipulation rather than full session compromise.

A fix is available in versions beyond the specified upper bounds in the affectedVersions list. Users should upgrade to versions at or beyond these fixed releases to remediate the vulnerability. No additional mitigation steps are indicated or necessary according to the provided data.