CVE-2025-4760: api control plane 4.5.0; +8 more affected products

Affected technology

api control plane · 4.5.0
wso2

api manager · 3.2.0
wso2

api manager · 3.2.1
wso2

api manager · 4.1.0
wso2

api manager · 4.2.0
wso2

api manager · 4.3.0
wso2

api manager · 4.4.0
wso2

api manager · 4.5.0
wso2

traffic manager · 4.5.0
wso2

universal gateway · 4.5.0
wso2

WSO2 API Manager · 3.2.0 to before 3.2.0.428, 3.2.1 to before 3.2.1.48, 4.1.0 to before 4.1.0.209, 4.2.0 to before 4.2.0.145, 4.3.0 to before 4.3.0.60, 4.4.0 to before 4.4.0.23, 4.5.0 to before 4.5.0.7
WSO2

WSO2 API Control Plane · 4.5.0 to before 4.5.0.8
WSO2

WSO2 Universal Gateway · 4.5.0 to before 4.5.0.7
WSO2

WSO2 Traffic Manager · 4.5.0 to before 4.5.0.7
WSO2

WSO2 Carbon API Management API · 6.7.206 to before 6.7.206.559, 6.7.210 to before 6.7.210.48, 9.20.74 to before 9.20.74.365, 9.28.116 to before 9.28.116.321, 9.29.120 to before 9.29.120.163, 9.30.67 to before 9.30.67.80, 9.31.86 to before 9.31.86.30
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · High privileges required · User interaction required

What an attacker can do

A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users. Source advisory’s CVSS 3.1 assessment (base score 4.8/10) rates confidentiality and integrity impact as low; availability impact as none.