2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.2.0.408","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.32","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.293","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.187","status":"affected","version":"4.1.0","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"8B00223A-8102-4887-A1A0-77B70ADDFFF5","versionEndExcluding":"3.2.0.408","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"A2CEF3D6-6A12-4933-8CAE-47870AC52DE7","versionEndExcluding":"3.2.1.32","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"45192132-C0AD-4E30-B2C0-864217FF1DCD","versionEndExcluding":"4.0.0.293","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"FD911958-DA13-4B7C-8657-9ABE655352AF","versionEndExcluding":"4.1.0.187","versionStartIncluding":"4.1.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser.\n\nBy leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag."}],"id":"CVE-2024-4867","lastModified":"2026-06-17T08:03:04.153","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.3,"impactScore":2.7,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-4867","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-04-16T12:20:00.908233Z","version":"2.0.3"}}]},"published":"2026-04-16T10:16:13.893","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":["Vendor Advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3391/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|