CVE-2024-5139
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.
| CWE | CWE-79 |
| Vendor | wso2 |
| Product | wso2 enterprise integrator |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 enterprise integrator
Be the first to know when new medium vulnerabilities affecting wso2 wso2 enterprise integrator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
WSO2 / WSO2 Enterprise Integrator
6.6.0 < 6.6.0.204
WSO2 / WSO2 Identity Server
5.10.0 < 5.10.0.310 6.0.0 < 6.0.0.212 6.1.0 < 6.1.0.195 7.0.0 < 7.0.0.64
WSO2 / WSO2 API Manager
3.1.0 < 3.1.0.286 3.2.0 < 3.2.0.376 3.2.1 < 3.2.1.10 4.0.0 < 4.0.0.299 4.1.0 < 4.1.0.159 4.2.0 < 4.2.0.91 4.3.0 < 4.3.0.6
WSO2 / WSO2 Open Banking AM
2.0.0 < 2.0.0.336
WSO2 / WSO2 Identity Server as Key Manager
5.10.0 < 5.10.0.306
WSO2 / WSO2 Open Banking IAM
2.0.0 < 2.0.0.357
WSO2 / WSO2 Carbon User Management UI
5.14.127 < 5.14.127.6 5.17.5 < 5.17.5.273 5.17.118 < 5.17.118.3 5.18.187 < 5.18.187.260 5.18.248 < 5.18.248.12 5.23.8 < 5.23.8.191 5.24.8 < 5.24.8.3 5.25.92 < 5.25.92.99 5.25.705 < 5.25.705.3 7.0.78 < 7.0.78.43