CVE-2025-10853: Reflected Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products Due to Improper Output Encoding
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By tampering with specific parameters, a malicious actor can inject arbitrary JavaScript into the response, leading to reflected XSS.
Successful exploitation could result in UI manipulation, redirection to malicious websites, or data theft from the browser. However, session-related sensitive cookies are protected with the httpOnly flag, which mitigates the risk of session hijacking.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10853?
CVE-2025-10853 is considered a high-severity vulnerability due to the potential for exploitation via reflected cross-site scripting.
How do I fix CVE-2025-10853?
To fix CVE-2025-10853, update your WSO2 products to the latest version that addresses this reflected XSS vulnerability.
What types of attacks can CVE-2025-10853 facilitate?
CVE-2025-10853 can facilitate JavaScript injection attacks that allow attackers to execute arbitrary scripts in users' browsers.
Which WSO2 products are affected by CVE-2025-10853?
CVE-2025-10853 affects multiple products from WSO2 where the management console is utilized.
How can I mitigate CVE-2025-10853 before applying a patch?
To mitigate CVE-2025-10853, implement input validation and output encoding for affected parameters to reduce XSS risk.