CVE-2025-6024: api manager 3.1.0, 3.2.0, 3.2.1 (+2 more affected versions); +3 more affected products

Affected technology

api manager · 3.1.0
wso2

api manager · 3.2.0
wso2

api manager · 3.2.1
wso2

api manager · 4.0.0
wso2

api manager · 4.1.0
wso2

identity server · 5.10.0
wso2

identity server · 5.11.0
wso2

WSO2 API Manager · 3.1.0 to before 3.1.0.351, 3.2.0 to before 3.2.0.455, 3.2.1 to before 3.2.1.74, 4.0.0 to before 4.0.0.375, 4.1.0 to before 4.1.0.238
WSO2

WSO2 Identity Server · 5.10.0 to before 5.10.0.360, 5.11.0 to before 5.11.0.405
WSO2

Description’s affected range: before rendering it in the web page

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

An attacker can leverage this by injecting malicious scripts into the authentication endpoint. Source advisory’s CVSS 3.1 assessment (base score 6.1/10) rates confidentiality and integrity impact as low; availability impact as none.