CVE-2025-6623: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WSO2 WSO2 API Manager

The WSO2 API Manager carbon console improperly neutralizes user-supplied XML input during web page generation, leading to a CWE-79 cross-site scripting vulnerability. This flaw allows remote attackers to inject and execute arbitrary JavaScript code in the context of a victim's browser. Although the vulnerability permits script execution that can manipulate the user interface or redirect users, session hijacking is not feasible due to the protection of session cookies by the httpOnly flag. The vulnerability affects multiple versions of WSO2 API Manager, specifically versions >=3.2.0 <3.2.0.433, >=3.2.1 <3.2.1.53, >=4.1.0 <4.1.0.215, >=4.2.0 <4.2.0.153, >=4.3.0 <4.3.0.66, >=4.4.0 <4.4.0.29, >=4.5.0 <4.5.0.12 (including 4.5.0 <4.5.0.11), >=5.2.26 <5.2.26.19, >=5.2.41 <5.2.41.6, >=5.2.57 <5.2.57.7, >=5.3.5 <5.3.5.4, >=5.3.11 <5.3.11.4, >=5.3.15 <5.3.15.3, and >=5.3.20 <5.3.20.1. No information about patches or fixes is provided.

Successful exploitation allows remote attackers to execute arbitrary JavaScript in the victim's browser context, which can lead to user interface manipulation or redirection to malicious sites. However, session hijacking is not possible because session cookies are protected by the httpOnly flag. The overall impact is limited to confidentiality and integrity of the web page content, with no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply strict input validation and encoding on XML inputs where possible and limit access to the carbon console to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.