CVE-2025-6024: Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Redirection to Malicious Websites
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can leverage this by injecting malicious scripts into the authentication endpoint. This can result in the user's browser being redirected to a malicious website, manipulation of the web page's user interface, or the retrieval of information from the browser. However, session hijacking is not possible due to the httpOnly flag protecting session-related cookies.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-6024?
CVE-2025-6024 is classified as a medium severity vulnerability due to potential exploitation through cross-site scripting.
How do I fix CVE-2025-6024?
To fix CVE-2025-6024, upgrade to the latest patched version of WSO2 products listed in the advisory.
What does CVE-2025-6024 affect?
CVE-2025-6024 affects multiple versions of WSO2 API Manager and WSO2 Identity Server due to a cross-site scripting vulnerability in the authentication endpoint.
Can CVE-2025-6024 be exploited remotely?
Yes, CVE-2025-6024 can be exploited remotely by attackers who craft a malicious input during the authentication process.
What symptoms indicate a potential exploitation of CVE-2025-6024?
Signs of potential exploitation of CVE-2025-6024 include unexpected redirects or scripts executing in the authentication interface.