Read the docs
TI-2025-43999 Aliases CVE-2025-12544GHSA-ggwq-mvcf-3gmx

Stored cross-site scripting in multiple WSO2 products

Priority LOW 21CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The WSO2 API Manager Publisher portal and the WSO2 Carbon API Manager Publisher REST API do not validate uploaded SVG files (CWE-79). A user with the Publisher role can upload a crafted SVG file that is stored and rendered, running scripts in victims' browsers. An attacker can redirect the victim's browser, alter the page or read browser data, but httpOnly cookies block session hijacking.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

Description from the CNA

The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.002 9th percentileScored 2026-11-07
Fix Fixed WSO2 API Manager (WSO2): 3.2.0.449, 3.2.1.68, 4.0.0.368 +2WSO2 Carbon API Manager Publisher REST API (WSO2): 9.28.140

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 API Manager3.2.0 to before 3.2.0.449; 3.2.1 to before 3.2.1.68; 4.0.0 to before 4.0.0.368; 4.1.0 to before 4.1.0.60; 4.2.0 to before 4.2.0.73.2.0.449, 3.2.1.68, 4.0.0.368, 4.1.0.60, 4.2.0.7Patch availableCNA
WSO2WSO2 Carbon API Manager Publisher REST APIbefore 9.28.1409.28.140Patch availableCNA
  • WSO2 API Manager VendorWSO2 Affected 3.2.0 to before 3.2.0.449; 3.2.1 to before 3.2.1.68; 4.0.0 to before 4.0.0.368; 4.1.0 to before 4.1.0.60; 4.2.0 to before 4.2.0.7 Fixed in 3.2.0.449, 3.2.1.68, 4.0.0.368, 4.1.0.60, 4.2.0.7 Patch available CNA
  • WSO2 Carbon API Manager Publisher REST API VendorWSO2 Affected before 9.28.140 Fixed in 9.28.140 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*——WSO2
  • cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

Upgrade WSO2 API Manager to 3.2.0.449, 3.2.1.68, 4.0.0.368, 4.1.0.60 or 4.2.0.7, matching the release line in use. Upgrade the WSO2 Carbon API Manager Publisher REST API to 9.28.140.

Written with Claude Haiku 5.5 from the sources below · 2026-11-05

  • Fix · CNA WSO2 API Manager (WSO2) Fixed in 3.2.0.449, 3.2.1.68, 4.0.0.368, 4.1.0.60, 4.2.0.7
  • Fix · CNA WSO2 Carbon API Manager Publisher REST API (WSO2) Fixed in 9.28.140

Timeline

  1. 2026-11-02 Threatist record created from CVE-2025-12544
  2. 2026-11-02 Alias added: GHSA-ggwq-mvcf-3gmx
  3. 2026-11-02 CISA SSVC decision points changed

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences