CVE-2024-8008

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

CVSS v3 5.2 MEDIUM

5.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.7

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:api_manager:3.1.0:::::::*
	cpe:2.3:a:wso2:api_manager:3.2.0:::::::*
	cpe:2.3:a:wso2:api_manager:3.2.1:::::::*
	cpe:2.3:a:wso2:api_manager:4.0.0:::::::*
	cpe:2.3:a:wso2:api_manager:4.1.0:-::::::
	cpe:2.3:a:wso2:api_manager:4.2.0:-::::::
	cpe:2.3:a:wso2:api_manager:4.3.0:-::::::
	cpe:2.3:a:wso2:enterprise_integrator:6.6.0:::::::*
	cpe:2.3:a:wso2:identity_server:5.10.0:::::::*
	cpe:2.3:a:wso2:identity_server:5.11.0:::::::*
	cpe:2.3:a:wso2:identity_server:6.0.0:::::::*
	cpe:2.3:a:wso2:identity_server:6.1.0:::::::*
	cpe:2.3:a:wso2:identity_server:7.0.0:::::::*
	cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:::::::*
	cpe:2.3:a:wso2:open_banking_am:2.0.0:::::::*
	cpe:2.3:a:wso2:open_banking_iam:2.0.0:::::::*

History

No history.

Information

Published : 2025-06-02 17:15

Updated : 2025-10-06 13:51

NVD link : CVE-2024-8008

Mitre link : CVE-2024-8008

CVE.ORG link : CVE-2024-8008

JSON object : View

Products Affected

wso2

identity_server
api_manager
identity_server_as_key_manager
open_banking_am
enterprise_integrator
open_banking_iam

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-8008", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.2, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.1}]}, "published": "2025-06-02T17:15:36.407", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.\n\nThis vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible."}, {"lang": "es", "value": "Existe una vulnerabilidad de cross-site-scripting (XSS) reflejado en varios productos [Vendor Name] debido a una codificaci\u00f3n de salida insuficiente en los mensajes de error generados por la solicitud de validaci\u00f3n de conexi\u00f3n del almac\u00e9n de usuarios JDBC. Un actor malicioso puede inyectar un payload especialmente manipulada en la solicitud, lo que provoca que el navegador ejecute JavaScript arbitrario en el contexto de la p\u00e1gina vulnerable. Esta vulnerabilidad puede permitir la manipulaci\u00f3n de la interfaz de usuario, la redirecci\u00f3n a sitios web maliciosos o la exfiltraci\u00f3n de datos del navegador. Sin embargo, dado que todas las cookies sensibles relacionadas con la sesi\u00f3n est\u00e1n protegidas con el indicador httpOnly, el secuestro de sesi\u00f3n no es posible."}], "lastModified": "2025-10-06T13:51:36.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1344FB79-0796-445C-A8F3-C03E995925D1"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"}, {"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4A07C73-3E6B-4CF9-BEB9-39C6081C0332"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B81C488-69D0-4A5C-AEED-31869C1BF5CA"}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65CD2558-C60C-4296-8E96-D4D804C598F0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8DF49C6-F2F6-4229-982E-0C0559265203"}, {"criteria": "cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6BB34405-A2F1-461A-B51B-E103BB3680A1"}, {"criteria": "cpe:2.3:a:wso2:open_banking_am:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94347800-04D2-48C4-ACF0-078A5ACBB063"}, {"criteria": "cpe:2.3:a:wso2:open_banking_iam:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7C241A3-8EA0-41E4-ABF3-21B9D8E7A5BE"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}