CVE-2025-6623: Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.
Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.
Affected Software
Event History
Frequently Asked Questions
What access and user interaction are required for exploitation?
An attacker needs high privileges to submit the malicious XML input. A victim must then interact with content that causes the stored script to run in their browser.
What can the injected script do, and what is protected?
The script can execute arbitrary JavaScript in the victim's browser context, including altering the console interface or redirecting the victim to a malicious site. Session hijacking through sensitive session cookies is not possible because those cookies use the httpOnly flag.