PT-2023-32784 · Wso2 · Wso2

Published 2023-12-15 · Updated 2023-12-28 · CVE-2023-6835

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description The issue is related to a lack of server-side input validation in the Forum feature, which could allow API rating manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-6835

GHSA-W7RX-824V-RGX5

Affected Products

Wso2

References · 9

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6835 · Security Note
• https://osv.dev/vulnerability/GHSA-w7rx-824v-rgx5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6835 · Vendor Advisory
• https://github.com/wso2/carbon-apimgt · Note
• https://github.com/wso2/carbon-apimgt/blob/81e0c0b8ed0bd2dace1e9006be21acbb731c835e/components/forum/org.wso2.carbon.forum/src/main/java/org/wso2/carbon/forum/registry/RegistryForumManager.java#L762 · Note
• https://github.com/wso2/carbon-apimgt/commit/2e9591b72bc286dfcd22b57768e984d867c902ba · Note
• https://twitter.com/VulmonFeeds/status/1735623964435656802 · Twitter Post
• https://twitter.com/CVEnew/status/1735592368428953726 · Twitter Post