CVE-2025-8154

תיאור (מקור, אנגלית)

In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.

מדדים

CVSS 3.1

7.5 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-2/8/2026

CWE

CWE-74

מוצרים מושפעים

wso2: api control plane; wso2: api manager; wso2: traffic manager; wso2: universal gateway

קישורים

• https://security.docs.wso2.com/en/latest/security-announcements/security-advis‮… Vendor Advisory