The vulnerability exists in the Swagger UI Try-out console within the API Publisher documentation of WSO2 API Manager versions 4.1.0 and 4.2.0. It permits an external Swagger API definition URL to be loaded, overriding the existing API definitions. This improper neutralization of input (CWE-79) can be exploited by attackers to deceive users into interacting with manipulated API definitions, which may lead to information exposure or unintended backend service requests. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

Exploitation of this vulnerability could allow attackers to trick users into interacting with maliciously altered API definitions in the API Publisher portal. This may result in the exposure of sensitive information or the initiation of unintended requests to backend services. There is no indication of direct confidentiality loss or system compromise, but the integrity of user interactions and API definitions can be affected.

No official patch or remediation level has been published by the vendor as of the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when using the Swagger UI Try-out console and avoid loading external Swagger API definition URLs from untrusted sources.