6.1

CVE-2024-5139: wso2 wso2 api manager Cross-site Scripting

CVSS: 6.1v3.1MediumAwaiting analysis
Published 21-10-2026Last modified 21-10-2026
Open JSON

Vulnerability summary

CVE-2024-5139 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in wso2 wso2 api manager.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 21-10-2026
    PublishedVulnerability first disclosed.

Description

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Wso27 products
  • wso2 api manager≥ 3.1.0, < 3.1.0.286 | ≥ 3.2.0, < 3.2.0.376 | ≥ 3.2.1, < 3.2.1.10 | ≥ 4.0.0, < 4.0.0.299 | ≥ 4.1.0, < 4.1.0.159 | ≥ 4.2.0, < 4.2.0.91 | ≥ 4.3.0, < 4.3.0.6
  • wso2 carbon user management ui≥ 5.14.127, < 5.14.127.6 | ≥ 5.17.5, < 5.17.5.273 | ≥ 5.17.118, < 5.17.118.3 | ≥ 5.18.187, < 5.18.187.260 | ≥ 5.18.248, < 5.18.248.12 | ≥ 5.23.8, < 5.23.8.191 | ≥ 5.24.8, < 5.24.8.3 | ≥ 5.25.92, < 5.25.92.99 | ≥ 5.25.705, < 5.25.705.3 | ≥ 7.0.78, < 7.0.78.43
  • wso2 enterprise integrator≥ 6.6.0, < 6.6.0.204
  • wso2 identity server≥ 5.10.0, < 5.10.0.310 | ≥ 6.0.0, < 6.0.0.212 | ≥ 6.1.0, < 6.1.0.195 | ≥ 7.0.0, < 7.0.0.64
  • wso2 identity server as key manager≥ 5.10.0, < 5.10.0.306

1 vendor · 7 products

References

3 links