WSO2 Identity Server vulnerability

What happened

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can cause the user's browser to redirect to a malicious website, modify the UI of the webpage, or retrieve information from the browser. However, the impact is mitigated by the use of httpOnly flags on session-related cookies, preventing session hijacking.

Affected versions

WSO2 Identity Server: 5.10.0 through before 5.10.0.381 (custom); 5.10.0 through before 5.10.0.384 (custom); 6.0.0 through before 6.0.0.255 (custom); 7.0.0 through before 7.0.0.131 (custom); 7.1.0 through before 7.1.0.21 (custom); 7.1.0 through before 7.1.0.51 (custom); 3.1.0 through before 3.1.0.355 (custom); 3.2.0 through before 3.2.0.459 (custom); 3.2.1 through before 3.2.1.78 (custom); 4.0.0 through before 4.0.0.380 (custom); 4.1.0 through before 4.1.0.243 (custom); 4.2.0 through before 4.2.0.183 (custom); 4.3.0 through before 4.3.0.94 (custom); 4.4.0 through before 4.4.0.58 (custom); 4.5.0 through before 4.5.0.43 (custom); 4.6.0 through before 4.6.0.7 (custom); 4.5.0 through before 4.5.0.44 (custom); 4.6.0 through before 4.6.0.8 (custom); 4.5.0 through before 4.5.0.42 (custom); 2.0.0 through before 2.0.0.404 (custom); 5.10.0 through before 5.10.0.375 (custom); 2.0.0 through before 2.0.0.424 (custom) Fixed: See vendor advisory.

Why it matters

Review the vendor advisory and exposure of the affected product to determine operational impact.

Detection & mitigation

• Apply vendor-provided updates or mitigations.
• Review affected product exposure and access logs.