CVE-2023-6911: XSS
First published: Mon Dec 18 2023(Updated: )
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.
Credit: ed10eef1-636d-4fbe-9993-6890dfa878f8 ed10eef1-636d-4fbe-9993-6890dfa878f8
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WSO2 API Manager | =2.2.0 | |
| WSO2 API Manager | =2.5.0 | |
| WSO2 API Manager | =2.6.0 | |
| WSO2 API Manager | =3.0.0 | |
| WSO2 API Manager | =3.1.0 | |
| WSO2 API Manager | =3.2.0 | |
| Wso2 Api Manager Analytics | =2.2.0 | |
| Wso2 Api Manager Analytics | =2.5.0 | |
| WSO2 API Microgateway | =2.2.0 | |
| WSO2 Data Analytics Server | =3.2.0 | |
| WSO2 Enterprise Integrator | =6.1.0 | |
| WSO2 Enterprise Integrator | =6.1.1 | |
| WSO2 Enterprise Integrator | =6.2.0 | |
| WSO2 Enterprise Integrator | =6.3.0 | |
| WSO2 Enterprise Integrator | =6.4.0 | |
| WSO2 Enterprise Integrator | =6.5.0 | |
| WSO2 Enterprise Integrator | =6.6.0 | |
| WSO2 Identity Server as Key Manager | =5.5.0 | |
| WSO2 Identity Server as Key Manager | =5.6.0 | |
| WSO2 Identity Server as Key Manager | =5.7.0 | |
| WSO2 Identity Server as Key Manager | =5.9.0 | |
| WSO2 Identity Server as Key Manager | =5.10.0 | |
| WSO2 Identity Server | =5.4.0 | |
| WSO2 Identity Server | =5.4.1 | |
| WSO2 Identity Server | =5.5.0 | |
| WSO2 Identity Server | =5.6.0 | |
| WSO2 Identity Server | =5.7.0 | |
| WSO2 Identity Server | =5.8.0 | |
| WSO2 Identity Server | =5.9.0 | |
| WSO2 Identity Server | =5.10.0 | |
| WSO2 Identity Server Analytics | =5.4.0 | |
| WSO2 Identity Server Analytics | =5.4.1 | |
| WSO2 Identity Server Analytics | =5.5.0 | |
| WSO2 Identity Server Analytics | =5.6.0 | |
| Wso2 Message Broker | =3.2.0 | |
| maven/org.wso2.carbon.registry:carbon-registry | <4.7.37 | 4.7.37 |
Remedy
For WSO2 Subscription holders, the recommended solution is to apply the provided patch/update to the affected versions of the products. If there are any instructions given with the patch/update, please make sure those are followed properly. Community users may apply the relevant fixes to the product based on the public fix(s) advertised in https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-rfq3-wpjh-ppvg
- alias/CVE-2023-6911
- collector/nvd-cve
- collector/github-advisory
- agent/type
- agent/author
- agent/softwarecombine
- agent/first-publish-date
- agent/references
- agent/severity
- agent/weakness
- agent/remedy
- agent/event
- agent/description
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- vendor/wso2
- canonical/wso2 api manager
- version/wso2 api manager/2.2.0
- version/wso2 api manager/2.5.0
- version/wso2 api manager/2.6.0
- version/wso2 api manager/3.0.0
- version/wso2 api manager/3.1.0
- version/wso2 api manager/3.2.0
- canonical/wso2 api manager analytics
- version/wso2 api manager analytics/2.2.0
- version/wso2 api manager analytics/2.5.0
- canonical/wso2 api microgateway
- version/wso2 api microgateway/2.2.0
- canonical/wso2 data analytics server
- version/wso2 data analytics server/3.2.0
- canonical/wso2 enterprise integrator
- version/wso2 enterprise integrator/6.1.0
- version/wso2 enterprise integrator/6.1.1
- version/wso2 enterprise integrator/6.2.0
- version/wso2 enterprise integrator/6.3.0
- version/wso2 enterprise integrator/6.4.0
- version/wso2 enterprise integrator/6.5.0
- version/wso2 enterprise integrator/6.6.0
- canonical/wso2 identity server as key manager
- version/wso2 identity server as key manager/5.5.0
- version/wso2 identity server as key manager/5.6.0
- version/wso2 identity server as key manager/5.7.0
- version/wso2 identity server as key manager/5.9.0
- version/wso2 identity server as key manager/5.10.0
- canonical/wso2 identity server
- version/wso2 identity server/5.4.0
- version/wso2 identity server/5.4.1
- version/wso2 identity server/5.5.0
- version/wso2 identity server/5.6.0
- version/wso2 identity server/5.7.0
- version/wso2 identity server/5.8.0
- version/wso2 identity server/5.9.0
- version/wso2 identity server/5.10.0
- canonical/wso2 identity server analytics
- version/wso2 identity server analytics/5.4.0
- version/wso2 identity server analytics/5.4.1
- version/wso2 identity server analytics/5.5.0
- version/wso2 identity server analytics/5.6.0
- canonical/wso2 message broker
- version/wso2 message broker/3.2.0
- package-manager/maven