CVE

CVE-2022-29548

6.1

CVSSmedium

Exploitable from an adjacent network · no authentication required · user interaction needed.

Description

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.

Attack Vector

Adjacent

Privileges Req.

None

User Interaction

Required

Updated Sep 18, 2026View on NVD →

S4E scanner

mediumProduct Based Web Vulnerabilities~10 seconds

CVE-2022-29548 Scanner

CVE-2022-29548 scanner - Cross-Site Scripting (XSS) vulnerability in WSO2 API Manager, API Manager Analytics, API Microgateway, Data Analytics Server, Enterprise Integrator, IS as Key Manager, Identity Server, Identity Server Analytics and WSO2 Micro Integrator

Used 2.2k times · 3.3k assets checked · url

Scanner page →Run scanner

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →