Description
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected products
- WSO2 / WSO2 API Control Plane4.5.0 – 4.5.0.21
- WSO2 / WSO2 API Manager4.1.0 – 4.1.0.218
- WSO2 / WSO2 API Manager4.2.0 – 4.2.0.164
- WSO2 / WSO2 API Manager4.3.0 – 4.3.0.74
- WSO2 / WSO2 API Manager4.4.0 – 4.4.0.38
- WSO2 / WSO2 API Manager4.5.0 – 4.5.0.20
- WSO2 / WSO2 API Manager0 – 4.1.0
- WSO2 / WSO2 Carbon API Gateway9.28.116 – 9.28.116.363
- WSO2 / WSO2 Carbon API Gateway9.20.74 – 9.20.74.374
- WSO2 / WSO2 Carbon API Gateway9.29.120 – 9.29.120.181
- WSO2 / WSO2 Carbon API Gateway9.30.67 – 9.30.67.104
- WSO2 / WSO2 Carbon API Gateway9.31.86 – 9.31.86.64
- WSO2 / WSO2 Carbon API Gateway9.32.2 – *
- WSO2 / WSO2 Carbon API Management Implementation9.30.67 – 9.30.67.104
- WSO2 / WSO2 Carbon API Management Implementation9.32.2 – *
- WSO2 / WSO2 Carbon API Management Implementation9.20.74 – 9.20.74.374
- WSO2 / WSO2 Carbon API Management Implementation9.29.120 – 9.29.120.181
- WSO2 / WSO2 Carbon API Management Implementation9.31.86 – 9.31.86.64
- WSO2 / WSO2 Carbon API Management Implementation9.28.116 – 9.28.116.363
- WSO2 / WSO2 Traffic Manager4.5.0 – 4.5.0.19
- WSO2 / WSO2 Universal Gateway4.5.0 – 4.5.0.19