Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
Summary
| CVE | CVE-2024-8008 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-06-02 17:15:36 UTC |
| Updated | 2026-10-16 12:16:31 UTC |
| Description | A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible. |
Risk And Classification
Primary CVSS: v3.1 5.2 MEDIUM from ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Problem Types: CWE-79 | CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | Secondary | 5.2 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 5.2 | MEDIUM | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Wso2 | Api Manager | 3.1.0 | All | All | All |
| Application | Wso2 | Api Manager | 3.2.0 | All | All | All |
| Application | Wso2 | Api Manager | 3.2.1 | All | All | All |
| Application | Wso2 | Api Manager | 4.0.0 | All | All | All |
| Application | Wso2 | Api Manager | 4.1.0 | - | All | All |
| Application | Wso2 | Api Manager | 4.2.0 | - | All | All |
| Application | Wso2 | Api Manager | 4.3.0 | - | All | All |
| Application | Wso2 | Enterprise Integrator | 6.6.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.10.0 | All | All | All |
| Application | Wso2 | Identity Server | 5.11.0 | All | All | All |
| Application | Wso2 | Identity Server | 6.0.0 | All | All | All |
| Application | Wso2 | Identity Server | 6.1.0 | All | All | All |
| Application | Wso2 | Identity Server | 7.0.0 | All | All | All |
| Application | Wso2 | Identity Server As Key Manager | 5.10.0 | All | All | All |
| Application | Wso2 | Open Banking Am | 2.0.0 | All | All | All |
| Application | Wso2 | Open Banking Iam | 2.0.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 Enterprise Integrator | unknown 6.6.0 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Integrator | affected 6.6.0 6.6.0.211 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | unknown 3.1.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.1.0 3.1.0.305 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.0 3.2.0.396 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.1 3.2.1.28 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.0.0 4.0.0.313 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.1.0 4.1.0.182 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.2.0 4.2.0.121 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.3.0 4.3.0.32 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.4.0 4.4.0.1 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.5.0 4.5.0.16 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.10.0 5.10.0.321 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.10.0 5.10.0.328 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.11.0 5.11.0.374 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.0.0 6.0.0.216 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.1.0 6.1.0.201 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.0.0 7.0.0.69 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | affected 2.0.0 2.0.0.374 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 2.0.0 2.0.0.354 custom | Not specified |
| CNA | WSO2 | WSO2 Traffic Manager | affected 4.5.0 4.5.0.16 custom | Not specified |
| CNA | WSO2 | WSO2 API Control Plane | affected 4.5.0 4.5.0.17 custom | Not specified |
| CNA | WSO2 | WSO2 Universal Gateway | affected 4.5.0 4.5.0.16 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.14.127 5.14.127.9 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.17.5 5.17.5.289 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.17.118 5.17.118.10 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.18.187 5.18.187.276 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.18.248 5.18.248.22 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.23.8 5.23.8.193 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.24.8 5.24.8.11 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.25.92 5.25.92.104 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.25.705 5.25.705.10 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.25.713 5.25.713.1 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 5.25.724 5.25.724.1 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | affected 7.0.78 7.0.78.46 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | unaffected 5.25.725 5.25.* custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | unaffected 5.27.0 5.27.* custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity User Store Configuration UI | unaffected 7.5.12 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution
There are currently no legacy QID mappings associated with this CVE.