CVE-2022-29548

    Dashboard / Vulnerabilities / CVE-2022-29548

    CVE-2022-29548

    Published: 21 Apr 2022Last Modified: 27 Aug 2026

    Summary:

    Details: A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

    References: http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.html, https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29548.json, https://nvd.nist.gov/vuln/detail/CVE-2022-29548, https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5473541ec4434aeb0a2a1f583d672e1d1748240a
    Fixed -None

    Affected versions

    2.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High