What’s Vulnerable › Vulnerabilities
CVE-2025-6508: User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests
- Severity: medium (CVSS 4.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-06 · updated 2026-09-29
- Weakness: CWE-79
Description
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.
Affected products
- WSO2 API Manager: from 4.1.0 before 4.1.0.212; from 4.2.0 before 4.2.0.183 — fixed in 4.1.0.212, 4.2.0.183
How to fix
Upgrade to a fixed version: WSO2 API Manager 4.1.0.212, 4.2.0.183. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-6508 or the next vulnerability affects your stack