Threats affecting pkg:maven/org.wso2/apim

The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

CVE-2025-6508 is a medium severity cross-site scripting (XSS) vulnerability in the Swagger UI Try-out console of WSO2 API Manager. It allows loading an external Swagger API definition URL, which can override existing API definitions in the API Publisher portal. This can mislead users into interacting with maliciously altered API definitions, potentially exposing sensitive information or causing unintended backend requests.

CVE-2025-8154 is a medium severity vulnerability in WSO2 API Manager versions 4.1.0 through 4.5.0. It involves improper neutralization of special elements in HTTP request headers during Webhook API invocations, allowing injection of arbitrary HTTP response headers. This can enable manipulation of browser caching, alteration of security headers, and potential exposure of sensitive information such as cookies, which may facilitate session hijacking. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.