CVE-2024-4867
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
16/04/2026
Last modified:
23/04/2026
Description
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user&#39;s browser.<br />
<br />
By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag.
Impact
Base Score 3.x
5.40
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* | 3.2.0 (including) | 3.2.0.408 (excluding) |
| cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* | 3.2.1 (including) | 3.2.1.32 (excluding) |
| cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* | 4.0.0 (including) | 4.0.0.293 (excluding) |
| cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* | 4.1.0 (including) | 4.1.0.187 (excluding) |
To consult the complete list of CPE names with products and versions, see this page