CVE-2025-8591

{"id": "CVE-2025-8591", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8591", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T11:04:42.314721Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.381", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.384", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.255", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.131", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.21", "versionType": "custom"}, {"status": "affected", "version": "7.1.0", "lessThan": "7.1.0.51", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.355", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.459", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.78", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.380", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.243", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.183", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.94", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.58", "versionType": "custom"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.43", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Control Plane", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.44", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.8", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Traffic Manager", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.42", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Universal Gateway", "versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.0.42", "versionType": "custom"}, {"status": "affected", "version": "4.6.0", "lessThan": "4.6.0.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.404", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.375", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.424", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-06T11:16:25.713", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4343/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application.\n\nBy leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking."}], "lastModified": "2026-07-09T13:04:39.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EEB2B5C-1661-45F4-9909-EAA1086B2038", "versionEndExcluding": "4.5.0.44", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "782317B4-CADB-48F1-9ED6-3423161C3AF7", "versionEndExcluding": "4.6.0.8", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B525D489-F3E2-401A-B52A-13C4ABE27E3B", "versionEndExcluding": "3.1.0.355", "versionStartIncluding": "3.1.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B47BAE2-5527-4E09-8968-E6A7F05393CE", "versionEndExcluding": "3.2.0.459", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DE13ADA-7B14-4E1A-A662-C977E52B9B69", "versionEndExcluding": "3.2.1.78", "versionStartIncluding": "3.2.1"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F90E6ED-EE4F-43FF-B0C3-BFD397D36D6B", "versionEndExcluding": "4.0.0.380", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C211F6A-1C4C-4748-A711-D7E607697DA7", "versionEndExcluding": "4.1.0.243", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8834ABC-9249-4969-BB84-F9ED80C8762C", "versionEndExcluding": "4.2.0.183", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CE615B5-9DDA-4DEA-A1BE-A660A30EF9F3", "versionEndExcluding": "4.3.0.94", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C45F22B9-AE3D-4F64-8458-1E80D95CF974", "versionEndExcluding": "4.4.0.58", "versionStartIncluding": "4.4.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6FA0582-8C11-413F-B5C3-C740C76C0F22", "versionEndExcluding": "4.5.0.43", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07D205A7-8BDF-47AA-B9C3-A5C0C018E654", "versionEndExcluding": "4.6.0.7", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92B2A962-462E-433E-A918-4A3949190754", "versionEndExcluding": "5.10.0.384", "versionStartIncluding": "5.10.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BA7443A-4D9D-4A72-8361-71CD14BFFC1F", "versionEndExcluding": "6.0.0.255", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "110F5D8D-32E8-4E7B-8925-D04781FC8B2D", "versionEndExcluding": "7.0.0.131", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "290B6F9F-C620-4C42-A095-58E2A6057C35", "versionEndExcluding": "7.1.0.51", "versionStartIncluding": "7.1.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBBDC7FF-75BF-44E2-A12E-1A39577421EA", "versionEndExcluding": "5.10.0.375", "versionStartIncluding": "5.10.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2CA09F50-25B4-40C7-BBD2-2456EF96898E", "versionEndExcluding": "2.0.0.404", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CC0BAF2-3A88-4EB1-9652-9DBFE8EF0674", "versionEndExcluding": "2.0.0.424", "versionStartIncluding": "2.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0337DA4D-6D6D-489A-BD02-DCF3CB3EDDE0", "versionEndExcluding": "4.5.0.42", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "90699855-9764-46ED-97C1-7720E22DEBE4", "versionEndExcluding": "4.6.0.7", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD5C8591-B117-4775-A083-D0C65120303A", "versionEndExcluding": "4.5.0.42", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FF82291-D261-4D97-915C-02B0CC65870F", "versionEndExcluding": "4.6.0.7", "versionStartIncluding": "4.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}