Wso2 Carbon Api Gateway

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:wso2:wso2_carbon_api_gateway:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorWso2 (a7ddf9c6-bb76-50d9-a2c9-02e60ad69877)
ProductWso2 Carbon Api Gateway (f04dc6cb-5531-5df1-9331-fe10ebf2ac6a)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-8154 not_vulnerable 2026-06-08 07:45:19.717406 HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
MEDIUM (5.3)
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
Published: 2026-05-11T09:30:36.027Z
Updated: 2026-05-11T12:43:47.037Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-8154 vulnerable 2026-06-08 07:45:19.716631 HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation
MEDIUM (5.3)
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a malicious actor can inject or overwrite arbitrary HTTP response headers. This can lead to various adverse effects, including the manipulation of browser caching, alteration of security-related headers, and the injection of sensitive information such as cookie values, potentially enabling session hijacking or other malicious activities.
Published: 2026-05-11T09:30:36.027Z
Updated: 2026-05-11T12:43:47.037Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.