$ cve CVE-2022-29548 JSON

CVE-2022-29548 EXPLOIT

4.6

MEDIUM · CVSS 3.1 · EPSS 41.1% (pctl 99)

Patch early

A public exploit exists.

Description

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

Scoring

CVSS	4.6 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS	41.08% — more likely to be exploited than 99% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2022-04-21
Last modified	2026-06-17

Affected (9)

Vendor	Product
wso2	api manager
wso2	api manager analytics
wso2	api microgateway
wso2	data analytics server
wso2	enterprise integrator
wso2	identity server
wso2	identity server analytics
wso2	identity server as key manager
wso2	micro integrator

Public exploits

Source	Title	Date
exploit-db	WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)	2022-06-27

References

→ the Explorer · watch your stack · NVD