Read the docs
TI-2024-39144 Aliases CVE-2024-5139GHSA-rh2p-8p77-h6xw

Cross-site scripting in WSO2 products via Authentication Endpoint

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

WSO2 Enterprise Integrator, WSO2 Identity Server, WSO2 API Manager, WSO2 Open Banking AM and WSO2 Open Banking IAM are affected. The Authentication Endpoint accepts unencoded user input (CWE-79), letting a remote attacker inject scripts. Scripts run when a user opens a crafted request, enabling redirects, page changes or browser data theft. Session hijacking is not possible because session cookies use httpOnly.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Fix Fixed WSO2 Enterprise Integrator (WSO2): 6.6.0.204WSO2 Identity Server (WSO2): 5.10.0.310, 6.0.0.212, 6.1.0.195 +1+5 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Enterprise Integrator6.6.0 to before 6.6.0.2046.6.0.204Patch availableCNA
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.310; 6.0.0 to before 6.0.0.212; 6.1.0 to before 6.1.0.195; 7.0.0 to before 7.0.0.645.10.0.310, 6.0.0.212, 6.1.0.195, 7.0.0.64Patch availableCNA
WSO2WSO2 API Manager3.1.0 to before 3.1.0.286; 3.2.0 to before 3.2.0.376; 3.2.1 to before 3.2.1.10; 4.0.0 to before 4.0.0.299; 4.1.0 to before 4.1.0.159; 4.2.0 to before 4.2.0.91; 4.3.0 to before 4.3.0.63.1.0.286, 3.2.0.376, 3.2.1.10, 4.0.0.299, 4.1.0.159, 4.2.0.91, 4.3.0.6Patch availableCNA
WSO2WSO2 Open Banking AM2.0.0 to before 2.0.0.3362.0.0.336Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3065.10.0.306Patch availableCNA
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.3572.0.0.357Patch availableCNA
WSO2WSO2 Carbon User Management UI5.14.127 to before 5.14.127.6; 5.17.5 to before 5.17.5.273; 5.17.118 to before 5.17.118.3; 5.18.187 to before 5.18.187.260; 5.18.248 to before 5.18.248.12; 5.23.8 to before 5.23.8.191; 5.24.8 to before 5.24.8.3; 5.25.92 to before 5.25.92.99; 5.25.705 to before 5.25.705.3; 7.0.78 to before 7.0.78.435.14.127.6, 5.17.5.273, 5.17.118.3, 5.18.187.260, 5.18.248.12, 5.23.8.191, 5.24.8.3, 5.25.92.99, 5.25.705.3, 7.0.78.43Patch availableCNA
  • WSO2 Enterprise Integrator VendorWSO2 Affected 6.6.0 to before 6.6.0.204 Fixed in 6.6.0.204 Patch available CNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.310; 6.0.0 to before 6.0.0.212; 6.1.0 to before 6.1.0.195; 7.0.0 to before 7.0.0.64 Fixed in 5.10.0.310, 6.0.0.212, 6.1.0.195, 7.0.0.64 Patch available CNA
  • WSO2 API Manager VendorWSO2 Affected 3.1.0 to before 3.1.0.286; 3.2.0 to before 3.2.0.376; 3.2.1 to before 3.2.1.10; 4.0.0 to before 4.0.0.299; 4.1.0 to before 4.1.0.159; 4.2.0 to before 4.2.0.91; 4.3.0 to before 4.3.0.6 Fixed in 3.1.0.286, 3.2.0.376, 3.2.1.10, 4.0.0.299, 4.1.0.159, 4.2.0.91, 4.3.0.6 Patch available CNA
  • WSO2 Open Banking AM VendorWSO2 Affected 2.0.0 to before 2.0.0.336 Fixed in 2.0.0.336 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.306 Fixed in 5.10.0.306 Patch available CNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.357 Fixed in 2.0.0.357 Patch available CNA
  • WSO2 Carbon User Management UI VendorWSO2 Affected 5.14.127 to before 5.14.127.6; 5.17.5 to before 5.17.5.273; 5.17.118 to before 5.17.118.3; 5.18.187 to before 5.18.187.260; 5.18.248 to before 5.18.248.12; 5.23.8 to before 5.23.8.191; 5.24.8 to before 5.24.8.3; 5.25.92 to before 5.25.92.99; 5.25.705 to before 5.25.705.3; 7.0.78 to before 7.0.78.43 Fixed in 5.14.127.6, 5.17.5.273, 5.17.118.3, 5.18.187.260, 5.18.248.12, 5.23.8.191, 5.24.8.3, 5.25.92.99, 5.25.705.3, 7.0.78.43 Patch available CNA

CPE names Threatist (inferred) · 2

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*——WSO2
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*——WSO2
  • cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions — — ·WSO2
  • cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

Fixed versions: Enterprise Integrator 6.6.0.204; Identity Server 5.10.0.310, 6.0.0.212, 6.1.0.195 and 7.0.0.64; Identity Server as Key Manager 5.10.0.306; API Manager 3.1.0.286, 3.2.0.376, 3.2.1.10, 4.0.0.299, 4.1.0.159, 4.2.0.91 and 4.3.0.6; Open Banking AM 2.0.0.336; Open Banking IAM 2.0.0.357; Carbon User Management UI 5.14.127.6, 5.17.5.273, 5.17.118.3, 5.18.187.260, 5.18.248.12, 5.23.8.191, 5.24.8.3, 5.25.92.99, 5.25.705.3 and 7.0.78.43.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA WSO2 Enterprise Integrator (WSO2) Fixed in 6.6.0.204
  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.310, 6.0.0.212, 6.1.0.195, 7.0.0.64
  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 3.1.0.286, 3.2.0.376, 3.2.1.10, 4.0.0.299, 4.1.0.159, 4.2.0.91, 4.3.0.6
  • Fix · CNA WSO2 Open Banking AM (WSO2) Fixed in 2.0.0.336
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.306
  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.357
  • Fix · CNA WSO2 Carbon User Management UI (WSO2) Fixed in 5.14.127.6, 5.17.5.273, 5.17.118.3, 5.18.187.260, 5.18.248.12, 5.23.8.191, 5.24.8.3, 5.25.92.99, 5.25.705.3, 7.0.78.43

Timeline

  1. 2026-10-21 Threatist record created from CVE-2024-5139
  2. 2026-10-21 Alias added: GHSA-rh2p-8p77-h6xw
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-30 CISA SSVC decision points changed

References

Patch 2

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences