Skip to content
OpenAdvisories
Medium · 4.8 CVE-2023-6911 EUVD-2023-3289GHSA-rfq3-wpjh-ppvg

WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability

Published Dec 18, 2023 · Updated Aug 2, 2024 · Assigned by WSO2

Vendor: WSO2 Product: WSO2 API Manager Product: WSO2 API Manager Analytics Product: WSO2 API Microgateway Product: WSO2 Data Analytics Server Product: WSO2 Enterprise Integrator Product: WSO2 Identity Server Product: WSO2 Identity Server Analytics Product: WSO2 IS as Key Manager Product: WSO2 Message Broker Package: org.wso2.carbon.registry:carbon-registry Ecosystem: Maven

Description

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

Affected products

VendorProductAffectedFixed
WSO2 WSO2 API Manager 2.2.0.0 – < 2.2.0.1, 2.5.0.0 – < 2.5.0.1, 2.6.0.0 – < 2.6.0.1, 3.0.0.0 – < 3.0.0.1, 3.1.0.0 – < 3.1.0.1, 3.2.0.0 – < 3.2.0.1 2.2.0.1
WSO2 WSO2 API Manager Analytics 2.2.0.0 – < 2.2.0.1, 2.5.0.0 – < 2.5.0.1 2.2.0.1
WSO2 WSO2 API Microgateway 2.2.0.0 – < 2.2.0.1 2.2.0.1
WSO2 WSO2 Data Analytics Server 3.2.0.0 – < 3.2.0.1 3.2.0.1
WSO2 WSO2 Enterprise Integrator 6.1.0.0 – < 6.1.0.9, 6.1.1.0 – < 6.1.1.9, 6.2.0.0 – < 6.2.0.7, 6.3.0.0 – < 6.3.0.1, 6.4.0.0 – < 6.4.0.1, 6.5.0.0 – < 6.5.0.6, 6.6.0.0 – < 6.6.0.11 6.1.0.9
WSO2 WSO2 IS as Key Manager 5.5.0.0 – < 5.5.0.1, 5.6.0.0 – < 5.6.0.1, 5.7.0.0 – < 5.7.0.1, 5.9.0.0 – < 5.9.0.1, 5.10.0.0 – < 5.10.0.1 5.5.0.1
WSO2 WSO2 Identity Server 5.4.0.0 – < 5.4.0.4, 5.4.1.0 – < 5.4.1.3, 5.5.0.0 – < 5.5.0.1, 5.6.0.0 – < 5.6.0.1, 5.7.0.0 – < 5.7.0.1, 5.8.0.0 – < 5.8.0.5, 5.9.0.0 – < 5.9.0.1, 5.10.0.0 – < 5.10.0.1 5.4.0.4
WSO2 WSO2 Identity Server Analytics 5.4.0.0 – < 5.4.0.2, 5.4.1.0 – < 5.4.1.2, 5.5.0.0 – < 5.5.0.1, 5.6.0.0 – < 5.6.0.1 5.4.0.2
WSO2 WSO2 Message Broker 3.2.0.0 – < 3.2.0.3 3.2.0.3

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.wso2.carbon.registry:carbon-registry < 4.7.37 4.7.37 GHSA-rfq3-wpjh-ppvg

References