Skip to content
TrackCVE
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2024-5848

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation

Medium6.1EPSS 0.23%
Published
Updated
Reserved
Assigned by
WSO2

Description

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper input validation. User-supplied data is directly included in server responses from vulnerable service endpoints without proper sanitization or encoding, allowing an attacker to inject malicious JavaScript. Successful exploitation could lead to UI manipulation, redirection to malicious websites, or data exfiltration from the browser. While session-related sensitive cookies are protected with the httpOnly flag, mitigating session hijacking risks, the impact may vary depending on gateway-level service restrictions.

Timeline

  1. ID reserved

    By WSO2

  2. · 9 months later

    Published

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2024-5848, by who scored it
Scored byCVSSScoreVector
WSO2CNA (assigner)3.1Medium6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVDNVD · Analyzed3.1Medium6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (exploitation in 30 days)
0.23% · top 86% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

Affected products

  • WSO2 · WSO2 API Manager

    • unknown < 3.1.0
    • affected 3.1.0 – < 3.1.0.285
    • affected 3.2.0 – < 3.2.0.375
    • affected 3.2.1 – < 3.2.1.10
    • affected 4.0.0 – < 4.0.0.300
    • affected 4.1.0 – < 4.1.0.160
    • affected 4.2.0 – < 4.2.0.92
    • affected 4.3.0 – < 4.3.0.10

  • WSO2 · WSO2 Open Banking AM

    • unknown < 2.0.0
    • affected 2.0.0 – < 2.0.0.349

What to do

Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3450/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2024/WSO2-2024-3450/#solution

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2024-5848 badge
[![CVE-2024-5848](https://trackcve.app/badge/CVE-2024-5848.svg)](https://trackcve.app/cve/CVE-2024-5848)

Record last updated .