CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

Score

CVSS 3.1 4.8 Medium

Status

Modified - ed10eef1-636d-4fbe-9993-6890dfa878f8

Published

2023-12-18

Last modified

2024-08-02

Weaknesses

CWE-79

Affected products

• Api Manager (Wso2)
• Api Manager Analytics (Wso2)
• Api Microgateway (Wso2)
• Data Analytics Server (Wso2)
• Enterprise Integrator (Wso2)
• Identity Server (Wso2)
• Identity Server Analytics (Wso2)
• Identity Server As Key Manager (Wso2)
• Message Broker (Wso2)
• Wso2 Api Manager (Wso2)
• Wso2 Api Manager Analytics (Wso2)
• Wso2 Api Microgateway (Wso2)
• Wso2 Data Analytics Server (Wso2)
• Wso2 Enterprise Integrator (Wso2)
• Wso2 Identity Server (Wso2)
• Wso2 Identity Server Analytics (Wso2)
• Wso2 Is As Key Manager (Wso2)
• Wso2 Message Broker (Wso2)

References

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/