The vulnerability in WSO2 API Manager's Swagger UI Try-out console permits an attacker to load an external Swagger API definition URL, overriding the API definitions shown in the Publisher portal. This improper neutralization of input during web page generation (CWE-79) can trick users into interacting with manipulated API definitions, leading to information exposure or unintended backend service requests. The issue affects versions 4.1.0 and 4.2.0. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, no privileges required, user interaction required, no confidentiality impact, limited integrity impact, and no availability impact. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Exploitation could allow attackers to deceive users by presenting malicious API definitions in the Swagger UI, potentially causing users to disclose sensitive information or trigger unintended requests to backend services. The integrity of user interactions with the API Publisher portal can be compromised, but there is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with the Swagger UI Try-out console and avoid loading untrusted external Swagger API definition URLs. Monitoring for updates from WSO2 is recommended.