PT-2025-45160 · Wso2 · Wso2 Products

Crnković · Published 2025-11-05 · Updated 2025-11-13 · CVE-2025-10853

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description A reflected cross-site scripting (XSS) issue exists in the management console of multiple WSO2 products because of improper output encoding. A malicious actor can inject arbitrary JavaScript into the response by manipulating specific parameters, resulting in reflected XSS. Successful exploitation could lead to UI manipulation, redirection to malicious websites, or data theft from the browser. Session-related sensitive cookies are protected with the httpOnly flag, which reduces the risk of session hijacking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10853

Affected Products

Wso2 Products

References · 5

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4486 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10853 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10853 · Vendor Advisory
• https://t.me/CVEtracker/36647 · Telegram Post
• https://t.me/cveNotify/142666 · Telegram Post