medium4.8
CVE-2023-6911
WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability
Impact
WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.wso2.carbon.registry:carbon-registry | < 4.7.37 | 4.7.37 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wso2 | Api Manager | Versions 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0 |
| Wso2 | Api Manager Analytics | Versions 2.2.0, 2.5.0 |
| Wso2 | Api Microgateway | Version 2.2.0 |
| Wso2 | Data Analytics Server | Version 3.2.0 |
| Wso2 | Enterprise Integrator | Versions 6.1.0, 6.1.1, 6.2.0, 6.3.0, 6.4.0, 6.5.0 |
| Wso2 | Identity Server As Key Manager | Versions 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0 |
| Wso2 | Identity Server | Versions 5.4.0, 5.4.1, 5.5.0, 5.6.0, 5.7.0, 5.8.0 |
| Wso2 | Identity Server Analytics | Versions 5.4.0, 5.4.1, 5.5.0, 5.6.0 |
| Wso2 | Message Broker | Version 3.2.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/
- https://github.com/advisories/GHSA-rfq3-wpjh-ppvg
- https://nvd.nist.gov/vuln/detail/CVE-2023-6911
- https://github.com/wso2/carbon-registry/commit/878fc7e53c90acc85e303d2af73440014a68b246