CVE-2025-6024

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6024", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2025-06-12T09:23:00.709Z", "datePublished": "2026-04-16T09:48:45.244Z", "dateUpdated": "2026-04-16T12:30:22.824Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-04-16T09:48:45.244Z"}, "title": "Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-104", "descriptions": [{"lang": "en", "value": "CAPEC-104 CAPEC-104: Cross-Site Scripting"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.351", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.455", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.74", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.375", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.238", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.360", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.405", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.\nAn attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.\nAn attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2025-4251", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T12:19:54.071212Z", "id": "CVE-2025-6024", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:30:22.824Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T12:19:54.071212Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T12:19:55.303Z"}}], "cna": {"title": "Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites", "source": {"advisory": "WSO2-2025-4251", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-104", "descriptions": [{"lang": "en", "value": "CAPEC-104 CAPEC-104: Cross-Site Scripting"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.351", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.455", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.74", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.375", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.238", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.360", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.405", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.\nAn attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.", "supportingMedia": [{"type": "text/html", "value": "The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.\nAn attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-04-16T09:48:45.244Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6024", "state": "PUBLISHED", "dateUpdated": "2026-04-16T12:30:22.824Z", "dateReserved": "2025-06-12T09:23:00.709Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-04-16T09:48:45.244Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "3.1.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "3.1.0.351", "status": "affected", "version": "3.1.0", "versionType": "custom"}, {"lessThan": "3.2.0.455", "status": "affected", "version": "3.2.0", "versionType": "custom"}, {"lessThan": "3.2.1.74", "status": "affected", "version": "3.2.1", "versionType": "custom"}, {"lessThan": "4.0.0.375", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "4.1.0.238", "status": "affected", "version": "4.1.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.10.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.10.0.360", "status": "affected", "version": "5.10.0", "versionType": "custom"}, {"lessThan": "5.11.0.405", "status": "affected", "version": "5.11.0", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.\nAn attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies."}, {"lang": "es", "value": "El punto final de autenticaci\u00f3n no codifica la entrada proporcionada por el usuario antes de renderizarla en la p\u00e1gina web, lo que permite la inyecci\u00f3n de scripts. Un atacante puede aprovechar esto inyectando scripts maliciosos en el punto final de autenticaci\u00f3n. Esto puede resultar en que el navegador del usuario sea redirigido a un sitio web malicioso, la manipulaci\u00f3n de la interfaz de usuario de la p\u00e1gina web, o la recuperaci\u00f3n de informaci\u00f3n del navegador. Sin embargo, el secuestro de sesi\u00f3n no es posible debido a la bandera httpOnly que protege las cookies relacionadas con la sesi\u00f3n."}], "id": "CVE-2025-6024", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6024", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T12:19:54.071212Z", "version": "2.0.3"}}]}, "published": "2026-04-16T10:16:14.243", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "tags": ["Vendor Advisory"], "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4251/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.1.0,3.1.0.351)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.0,3.2.0.455)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.1,3.2.1.74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0.0,4.0.0.375)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0,4.1.0.238)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 API Manager", "source": "cna", "vendor": "WSO2"}, "product": "wso2_api_manager", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10.0,5.10.0.360)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.11.0,5.11.0.405)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server", "source": "cna", "vendor": "WSO2"}, "product": "wso2_identity_server", "vendor": "wso2"}], "analysis": {"en": {"generated_at": "2026-04-17T04:52:30.499915+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011issued patch as described in the WSO2 advisory", "Upgrade to the latest product release that includes the fix if the patch is not yet available", "Configure a strict content\u2011security\u2011policy to restrict script execution on the authentication endpoint"], "summary": {"action": "Immediate Patch", "impact": "Cross\u2011Site Scripting enabling redirects and information theft"}, "threat_synthesis": {"affected_systems": "The vulnerability affects WSO2 API Manager and WSO2 Identity Server. Specific product versions are not listed in the advisory, so all recent releases should be verified for a fix.", "description_and_impact": "The authentication endpoint in WSO2 products does not encode user\u2011supplied input before rendering it, creating a cross\u2011site scripting vulnerability. An attacker can embed malicious JavaScript into the endpoint, which the victim\u2019s browser will execute. The script can redirect the user to a malicious site, alter the page\u2019s user interface, or exfiltrate data stored in the browser. Session hijacking is not feasible because session cookies are protected with the httpOnly flag.", "risk_and_exploitability": "This issue carries a moderate CVSS score of 6.1, with an EPSS score of 0.0003 and has not yet been listed in the CISA KEV catalog. Because the flaw resides in a public authentication endpoint, exploitation is possible over the internet when a user visits or interacts with the vulnerable page. The attack required the victim\u2019s browser to load the injected script, implying a user\u2011interaction component, but developers or attackers can craft malicious links to entice users. The absence of session cookie compromise limits the threat to client\u2011side damage and data theft rather than full account takeover."}}}}, "created": "2026-04-16T12:30:05.967461+00:00", "updated": "2026-04-17T05:00:05.504367+00:00", "vendors": ["wso2", "wso2$PRODUCT$wso2_api_manager", "wso2$PRODUCT$wso2_identity_server"]}