{"schema":"threatline.record/2","record":{"id":"CVE-2025-6623","aliases":[],"summary":"Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection","details":"The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts.\n\nSuccessful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actions such as redirecting the user to a malicious website or modifying the web page's user interface. Session hijacking is not possible as sensitive session cookies are protected by the httpOnly flag.","categories":["Unclassified"],"product":"WSO2 API Manager","vendor":"WSO2","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"3.2.0","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.433","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.53","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.215","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.153","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.66","versionType":"custom"},{"status":"affected","version":"4.4.0","lessThan":"4.4.0.29","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.11","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Universal Gateway","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.11","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Traffic Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.11","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 API Control Plane","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"4.5.0","versionType":"custom"},{"status":"affected","version":"4.5.0","lessThan":"4.5.0.12","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon Event Publisher UI","vendor":"WSO2","versions":[{"status":"affected","version":"5.2.26","lessThan":"5.2.26.19","versionType":"custom"},{"status":"affected","version":"5.2.41","lessThan":"5.2.41.6","versionType":"custom"},{"status":"affected","version":"5.2.57","lessThan":"5.2.57.7","versionType":"custom"},{"status":"affected","version":"5.3.5","lessThan":"5.3.5.4","versionType":"custom"},{"status":"affected","version":"5.3.11","lessThan":"5.3.11.4","versionType":"custom"},{"status":"affected","version":"5.3.15","lessThan":"5.3.15.3","versionType":"custom"},{"status":"affected","version":"5.3.20","lessThan":"5.3.20.1","versionType":"custom"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon Event Receiver UI","vendor":"WSO2","versions":[{"status":"affected","version":"5.2.26","lessThan":"5.2.26.19","versionType":"custom"},{"status":"affected","version":"5.2.41","lessThan":"5.2.41.6","versionType":"custom"},{"status":"affected","version":"5.2.57","lessThan":"5.2.57.7","versionType":"custom"},{"status":"affected","version":"5.3.5","lessThan":"5.3.5.4","versionType":"custom"},{"status":"affected","version":"5.3.11","lessThan":"5.3.11.4","versionType":"custom"},{"status":"affected","version":"5.3.15","lessThan":"5.3.15.3","versionType":"custom"},{"status":"affected","version":"5.3.20","lessThan":"5.3.20.1","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.0.433","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.1.53","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.1.0.215","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.2.0.153","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.3.0.66","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.4.0.29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.5.0.11","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Universal Gateway","ecosystem":null},"version":"4.5.0.11","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Traffic Manager","ecosystem":null},"version":"4.5.0.11","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Control Plane","ecosystem":null},"version":"4.5.0.12","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Publisher UI","ecosystem":null},"version":"5.2.26.19","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Publisher UI","ecosystem":null},"version":"5.2.41.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Publisher UI","ecosystem":null},"version":"5.2.57.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Publisher UI","ecosystem":null},"version":"5.3.5.4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Publisher UI","ecosystem":null},"version":"5.3.11.4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Publisher UI","ecosystem":null},"version":"5.3.15.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Publisher UI","ecosystem":null},"version":"5.3.20.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Receiver UI","ecosystem":null},"version":"5.2.26.19","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Receiver UI","ecosystem":null},"version":"5.2.41.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Receiver UI","ecosystem":null},"version":"5.2.57.7","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Receiver UI","ecosystem":null},"version":"5.3.5.4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Receiver UI","ecosystem":null},"version":"5.3.11.4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Receiver UI","ecosystem":null},"version":"5.3.15.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","source_modified_at":"2026-10-20T19:29:07.389Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Event Receiver UI","ecosystem":null},"version":"5.3.20.1","basis":"first unaffected version stated in the CVE record"}],"cvss":4.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00222,"percentile":0.12148,"score_date":"2026-10-23"},"published_at":"2026-10-19T16:25:50.419Z","modified_at":"2026-10-20T19:29:07.389Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-6623","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T19:29:07.389Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-6623","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4316/","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/wso2/carbon-analytics-common/pull/870","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-20T19:28:59.129388Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T19:29:07.389Z","content_hash":"3c83ebc6d4bc83ac7e0517c2f74aadaa3c33d81d61821e5c03dcef8d87d32949"}}