CVE-2022-29548

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

• CWE-79

• http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603/
• http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603Vendor Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603/

Published

Apr 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29537gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0…5.5
• CVE-2022-29538RESI Gemini-Net Web 4.2 is affected by Improper Access Contr…5.3
• CVE-2022-29539resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Comm…9.8
• CVE-2022-29540resi-calltrace in RESI Gemini-Net 4.2 is affected by Multipl…6.1
• CVE-2022-29546HtmlUnit NekoHtml Parser before 2.61.0 suffers from a denial…7.5
• CVE-2022-29547The CreateRedirect extension before 2022-04-14 for MediaWiki…7.5
• CVE-2022-29549An issue was discovered in Qualys Cloud Agent 4.8.0-49. It e…7.3
• CVE-2022-29550An issue was discovered in Qualys Cloud Agent 4.8.0-49. It w…5.5
• CVE-2022-29555The Deviceconnect microservice through 1.3.0 in Northern.tec…8.8
• CVE-2022-29556The iot-manager microservice 1.0.0 in Northern.tech Mender E…9.8
• CVE-2022-29557LexisNexis Firco Compliance Link 3.7 allows CSRF.8.8
• CVE-2022-29558Realtek rtl819x-SDK before v3.6.1 allows command injection o…8.8