5.3Media
CVE-2025-8154HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
Descripción
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
Debilidad (CWE):
CWE-74
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| wso2 | api control plane | 4.5.0 – < 4.5.0.21 | |
| wso2 | api manager | 4.1.0 – < 4.1.0.218 | |
| wso2 | traffic manager | 4.5.0 – < 4.5.0.19 | |
| wso2 | universal gateway | 4.5.0 – < 4.5.0.19 | |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.21 | |
| WSO2 | WSO2 API Manager | 4.1.0 – < 4.1.0.218, 4.2.0 – < 4.2.0.164, 4.3.0 – < 4.3.0.74, 4.4.0 – < 4.4.0.38, 4.5.0 – < 4.5.0.20 | |
| WSO2 | WSO2 Carbon API Gateway | 9.20.74 – < 9.20.74.374, 9.28.116 – < 9.28.116.363, 9.29.120 – < 9.29.120.181, 9.30.67 – < 9.30.67.104, 9.31.86 – < 9.31.86.64 | |
| WSO2 | WSO2 Carbon API Management Implementation | 9.20.74 – < 9.20.74.374, 9.28.116 – < 9.28.116.363, 9.29.120 – < 9.29.120.181, 9.30.67 – < 9.30.67.104, 9.31.86 – < 9.31.86.64 | |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.19 | |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.19 |
Referencias y parches
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4410/ vendor-advisoryVendor Advisory
Coincidencias CPE (NVD) (8)
cpe:2.3:a:wso2:api_control_plane:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.21cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.1.0 < 4.1.0.218cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.2.0 < 4.2.0.164cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.3.0 < 4.3.0.74cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.4.0 < 4.4.0.38cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.20cpe:2.3:a:wso2:traffic_manager:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.19cpe:2.3:a:wso2:universal_gateway:*:*:*:*:*:*:*:*≥ 4.5.0 < 4.5.0.19