CVE-2023-6911

Published: Dec 18, 2023Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

Affected (35)

Products: Wso2: Api Manager, Api Manager Analytics, Api Microgateway, Data Analytics Server, Enterprise Integrator, Identity Server As Key Manager, Identity Server, Identity Server Analytics, Message Broker

Wso2

9 products

Api Manager

Api Manager Analytics

Api Microgateway

Data Analytics Server

Enterprise Integrator

Identity Server As Key Manager

Identity Server

Identity Server Analytics

Message Broker

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Manager	Version 2.2.0
Wso2 Api Manager	Version 2.5.0
Wso2 Api Manager	Version 2.6.0
Wso2 Api Manager	Version 3.0.0
Wso2 Api Manager	Version 3.1.0
Wso2 Api Manager	Version 3.2.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Manager Analytics	Version 2.2.0
Wso2 Api Manager Analytics	Version 2.5.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Microgateway	Version 2.2.0

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Wso2 Data Analytics Server	Version 3.2.0

Configuration E

7 vulnerable

Vulnerable Software	Affected Versions
Wso2 Enterprise Integrator	Version 6.1.0
Wso2 Enterprise Integrator	Version 6.1.1
Wso2 Enterprise Integrator	Version 6.2.0
Wso2 Enterprise Integrator	Version 6.3.0
Wso2 Enterprise Integrator	Version 6.4.0
Wso2 Enterprise Integrator	Version 6.5.0
Wso2 Enterprise Integrator	Version 6.6.0

Configuration F

5 vulnerable

Vulnerable Software	Affected Versions
Wso2 Identity Server As Key Manager	Version 5.10.0
Wso2 Identity Server As Key Manager	Version 5.5.0
Wso2 Identity Server As Key Manager	Version 5.6.0
Wso2 Identity Server As Key Manager	Version 5.7.0
Wso2 Identity Server As Key Manager	Version 5.9.0

Configuration G

8 vulnerable

Vulnerable Software	Affected Versions
Wso2 Identity Server	Version 5.10.0
Wso2 Identity Server	Version 5.4.0
Wso2 Identity Server	Version 5.4.1
Wso2 Identity Server	Version 5.5.0
Wso2 Identity Server	Version 5.6.0
Wso2 Identity Server	Version 5.7.0
Wso2 Identity Server	Version 5.8.0
Wso2 Identity Server	Version 5.9.0

Configuration H

4 vulnerable

Vulnerable Software	Affected Versions
Wso2 Identity Server Analytics	Version 5.4.0
Wso2 Identity Server Analytics	Version 5.4.1
Wso2 Identity Server Analytics	Version 5.5.0
Wso2 Identity Server Analytics	Version 5.6.0

Configuration I

1 vulnerable

Vulnerable Software	Affected Versions
Wso2 Message Broker	Version 3.2.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

Vendor Advisory

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.