4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-4760

CVE-2025-4760: WSO2 carbon-apimgt affected by an authenticated stored cross-site scripting (XSS) vulnerability

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript, which is later rendered in the browser when accessed by other users.

A successful attack could result in redirection to malicious websites, unauthorized UI modifications, or exfiltration of browser-accessible data. However, session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-4760

CVE-2025-4760:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.api	maven	< 9.31.117	9.31.117
org.wso2.carbon.apimgt:org.wso2.carbon.apimgt.rest.api.publisher.v1	maven	< 9.31.117	9.31.117

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the API Publisher portal of WSO2 API Manager. It stems from improper validation of documents uploaded for APIs and API Products. The root cause is that the application trusted the user-supplied Content-Type HTTP header and did not verify that the file's actual content matched its extension.

The analysis of the patch commit 1b3496c072ec68aaaf726996e2caa76f07c1adca reveals the exact functions involved. The exploitation flow starts at the REST API endpoints addAPIDocumentContent (for APIs) and addAPIProductDocumentContent (for API Products). These endpoints receive the file upload from a privileged user.

Prior to the patch, these endpoints called the utility functions attachFileToDocument and attachFileToProductDocument, respectively. These utility functions contained the flawed logic of determining the file's media type based on the Content-Type header. This allowed an attacker to upload a file with a seemingly safe extension (e.g., .txt) but with a Content-Type of text/html and malicious JavaScript payload inside. When another user viewed this document, the browser would render the HTML and execute the script.

The patch addresses this by introducing a new utility function, detectAndValidateMediaType, which uses the Apache Tika library to detect the MIME type from the file's byte content. It then ensures that the detected MIME type corresponds to the file's extension. This prevents the mismatch that allowed the XSS attack. The vulnerable functions are the API endpoints that accept the input and the utility functions that processed it without proper validation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.