CVE-2025-6623: WSO2 API Manager 3.2.0 to before 3.2.0.433, 3.2.1 to before 3.2.1.53, 4.1.0 to before 4.1.0.215, 4.2.0 to before…

Affected technology

WSO2 API Manager · 3.2.0 to before 3.2.0.433, 3.2.1 to before 3.2.1.53, 4.1.0 to before 4.1.0.215, 4.2.0 to before 4.2.0.153, 4.3.0 to before 4.3.0.66, 4.4.0 to before 4.4.0.29, 4.5.0 to before 4.5.0.11
WSO2

WSO2 Universal Gateway · 4.5.0 to before 4.5.0.11
WSO2

WSO2 Traffic Manager · 4.5.0 to before 4.5.0.11
WSO2

WSO2 API Control Plane · 4.5.0 to before 4.5.0.12
WSO2

WSO2 Carbon Event Publisher UI · 5.2.26 to before 5.2.26.19, 5.2.41 to before 5.2.41.6, 5.2.57 to before 5.2.57.7, 5.3.5 to before 5.3.5.4, 5.3.11 to before 5.3.11.4, 5.3.15 to before 5.3.15.3, 5.3.20 to before 5.3.20.1
WSO2

WSO2 Carbon Event Receiver UI · 5.2.26 to before 5.2.26.19, 5.2.41 to before 5.2.41.6, 5.2.57 to before 5.2.57.7, 5.3.5 to before 5.3.5.4, 5.3.11 to before 5.3.11.4, 5.3.15 to before 5.3.15.3, 5.3.20 to before 5.3.20.1
WSO2

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Adjacent network · High privileges required · User interaction required

What an attacker can do

A remote attacker can execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Source advisory’s CVSS 3.1 assessment (base score 4.3/10) rates confidentiality and integrity impact as low; availability impact as none.