CVE-2024-8008
Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
- Published
- Updated
- Reserved
- Assigned by
- WSO2
Description
A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page. This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.
Timeline
ID reserved
By WSO2
- 10 months later
· 10 months later
Published
- 17 months later
· 17 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| WSO2CNA (assigner) | 3.1 | Medium5.2 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.2 | CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.55% · top 54% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.2.
Weakness
Affected products
WSO2 · WSO2 Enterprise Integrator
- unknown < 6.6.0
- affected 6.6.0 – < 6.6.0.211
- unknown < 3.1.0
- affected 3.1.0 – < 3.1.0.305
- affected 3.2.0 – < 3.2.0.396
- affected 3.2.1 – < 3.2.1.28
- affected 4.0.0 – < 4.0.0.313
- affected 4.1.0 – < 4.1.0.182
- affected 4.2.0 – < 4.2.0.121
- affected 4.3.0 – < 4.3.0.32
- affected 4.4.0 – < 4.4.0.1
- affected 4.5.0 – < 4.5.0.16
WSO2 · WSO2 Identity Server as Key Manager
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.321
- unknown < 5.10.0
- affected 5.10.0 – < 5.10.0.328
- affected 5.11.0 – < 5.11.0.374
- affected 6.0.0 – < 6.0.0.216
- affected 6.1.0 – < 6.1.0.201
- affected 7.0.0 – < 7.0.0.69
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.374
- unknown < 2.0.0
- affected 2.0.0 – < 2.0.0.354
- affected 4.5.0 – < 4.5.0.16
- affected 4.5.0 – < 4.5.0.17
- affected 4.5.0 – < 4.5.0.16
WSO2 · WSO2 Carbon Identity User Store Configuration UI
- affected 5.14.127 – < 5.14.127.9
- affected 5.17.5 – < 5.17.5.289
- affected 5.17.118 – < 5.17.118.10
- affected 5.18.187 – < 5.18.187.276
- affected 5.18.248 – < 5.18.248.22
- affected 5.23.8 – < 5.23.8.193
- affected 5.24.8 – < 5.24.8.11
- affected 5.25.92 – < 5.25.92.104
- affected 5.25.705 – < 5.25.705.10
- affected 5.25.713 – < 5.25.713.1
- affected 5.25.724 – < 5.25.724.1
- affected 7.0.78 – < 7.0.78.46
- unaffected 5.25.725 – ≤ 5.25.*
- unaffected 5.27.0 – ≤ 5.27.*
- unaffected 7.5.12 – ≤ *
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.uiGHSA-xpxp-r8hf-wgf6 (opens in a new tab)
What to do
Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/#solution
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-xpxp-r8hf-wgf6 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-8008)Record last updated .