---
id: CVE-2024-8008
title: >-
  A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2
  products due to insufficient output encoding in error messages generated by
  the JDBC user store connection validation request
summary: >-
  A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2
  products due to insufficient output encoding in error messages generated by
  the JDBC user store connection validation request. A malicious actor can
  inject a sp…
severity: medium
cvss: 5.2
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: wso2
product: api_manager
affected:
  - api_manager = 3.1.0
  - api_manager = 3.2.0
  - api_manager = 3.2.1
  - api_manager = 4.0.0
  - api_manager = 4.1.0
  - api_manager = 4.2.0
  - api_manager = 4.3.0
  - enterprise_integrator = 6.6.0
  - identity_server = 5.10.0
  - identity_server = 5.11.0
  - identity_server = 6.0.0
  - identity_server = 6.1.0
  - identity_server = 7.0.0
  - identity_server_as_key_manager = 5.10.0
  - open_banking_am = 2.0.0
  - open_banking_iam = 2.0.0
published: '2025-06-02'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T12:16:31.053'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-8008'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3178/
    label: ed10eef1-636d-4fbe-9993-6890dfa878f8
tags:
  - nvd
  - cve.org
epss: 0.0053
epssPercentile: 0.44651
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-06-02T17:05:11.526830Z'
ingestedAt: '2026-10-16T12:05:46.481Z'
---

## Overview

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser to execute arbitrary JavaScript in the context of the vulnerable page.

This vulnerability may allow UI manipulation, redirection to malicious websites, or data exfiltration from the browser. However, since all session-related sensitive cookies are protected with the httpOnly flag, session hijacking is not possible.

## Affected

- `api_manager = 3.1.0`
- `api_manager = 3.2.0`
- `api_manager = 3.2.1`
- `api_manager = 4.0.0`
- `api_manager = 4.1.0`
- `api_manager = 4.2.0`
- `api_manager = 4.3.0`
- `enterprise_integrator = 6.6.0`
- `identity_server = 5.10.0`
- `identity_server = 5.11.0`
- `identity_server = 6.0.0`
- `identity_server = 6.1.0`
- `identity_server = 7.0.0`
- `identity_server_as_key_manager = 5.10.0`
- `open_banking_am = 2.0.0`
- `open_banking_iam = 2.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.