CVE-2023-6835: Input Validation
First published: Fri Dec 15 2023(Updated: )
Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.
Credit: ed10eef1-636d-4fbe-9993-6890dfa878f8 ed10eef1-636d-4fbe-9993-6890dfa878f8
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.wso2.carbon.apimgt:forum | <=9.0.78 | |
| WSO2 API Manager | =2.2.0 | |
| WSO2 API Manager | =2.5.0 | |
| WSO2 API Manager | =2.6.0 | |
| Wso2 Iot Server | =3.3.1 | |
| =2.2.0 | ||
| =2.5.0 | ||
| =2.6.0 | ||
| =3.3.1 |
Remedy
For WSO2 Subscription holders, the recommended solution is to apply the provided patch/update to the affected versions of the products. If there are any instructions given with the patch/update, please make sure those are followed properly. Community users may apply the relevant fixes to the product based on the public fix(s) advertised in https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357/
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-6835
- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357/
- https://github.com/wso2/carbon-apimgt/commit/2e9591b72bc286dfcd22b57768e984d867c902ba
- https://github.com/wso2/carbon-apimgt/blob/81e0c0b8ed0bd2dace1e9006be21acbb731c835e/components/forum/org.wso2.carbon.forum/src/main/java/org/wso2/carbon/forum/registry/RegistryForumManager.java#L762
- https://github.com/advisories/GHSA-w7rx-824v-rgx5 (Advisory)
- collector/github-advisory-latest
- alias/GHSA-w7rx-824v-rgx5
- alias/CVE-2023-6835
- collector/github-advisory
- agent/type
- agent/first-publish-date
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/remedy
- agent/description
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-cve
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/trending
- package-manager/maven
- vendor/wso2
- canonical/wso2 api manager
- version/wso2 api manager/2.2.0
- version/wso2 api manager/2.5.0
- version/wso2 api manager/2.6.0
- canonical/wso2 iot server
- version/wso2 iot server/3.3.1