| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api | < 9.31.117 | 9.31.117 |
| org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1 | < 9.31.117 | 9.31.117 |
| api control plane | = 4.5.0 | |
| api manager | = 3.2.0= 3.2.1= 4.1.0= 4.2.0= 4.3.0= 4.4.0= 4.5.0 | |
| traffic manager | = 4.5.0 | |
| universal gateway | = 4.5.0 |
An authenticated stored Cross-Site Scripting (XSS) vulnerability exists in WSO2 API Manager components (carbon-apimgt) due to insufficient validation of user-supplied input during API document upload in the Publisher portal.
A user with publisher privileges can upload a crafted API document whose contents are later rendered in the UI for other users, leading to attacker-controlled script execution. Likely outcomes include redirection to malicious sites, unauthorized UI modifications, or exfiltration of data accessible to the browser; session hijacking is mitigated by the use of HttpOnly session cookies.
To remediate, update to version 9.31.117 or above.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン