NetSight
IP …
medium4.6Public exploit code

CVE-2022-29548

A reflected XSS issue exists in the Management Console of several WSO2 products.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

Affected products

VendorProductAffected versions
Wso2Api Manager
Versions 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0
Wso2Api Manager Analytics
Versions 2.2.0, 2.5.0, 2.6.0
Wso2Api Microgateway
Version 2.2.0
Wso2Data Analytics Server
Version 3.2.0
Wso2Enterprise Integrator
Versions 6.2.0, 6.3.0, 6.4.0, 6.5.0, 6.6.0
Wso2Identity Server
Versions 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, 5.11.0
Wso2Identity Server Analytics
Versions 5.5.0, 5.6.0
Wso2Identity Server As Key Manager
Versions 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0
Wso2Micro Integrator
Version 1.0.0

Weakness classification

CWE-79

References