CVE-2025-8591: Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification
The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application.
By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8591?
CVE-2025-8591 has a medium severity score of 6.1.
How do I fix CVE-2025-8591?
To fix CVE-2025-8591, ensure that all user-supplied input via URL parameters is properly validated and output-encoded before reflection.
What impact can CVE-2025-8591 have?
CVE-2025-8591 can allow an attacker to inject malicious scripts into web pages, leading to potential unauthorized UI modification.
Which software is affected by CVE-2025-8591?
CVE-2025-8591 affects multiple WSO2 products that process user input via URL parameters.
How can attackers exploit CVE-2025-8591?
Attackers can exploit CVE-2025-8591 by crafting malicious URL parameters that execute scripts in the victim's browser.