PT-2023-32819 · Wso2 · Wso2

Published 2023-12-18 · Updated 2023-12-22 · CVE-2023-6911

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description The issue is related to improper output encoding, allowing a Stored Cross Site Scripting (XSS) attack. An attacker can inject a malicious payload into the Registry feature of the Management Console. This can lead to the execution of malicious scripts, potentially compromising the security of the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6911

GHSA-RFQ3-WPJH-PPVG

Affected Products

Wso2

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-6911 · Security Note
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rfq3-wpjh-ppvg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6911 · Vendor Advisory
• https://github.com/wso2/carbon-registry · Note
• https://github.com/wso2/carbon-registry/commit/878fc7e53c90acc85e303d2af73440014a68b246 · Note
• https://t.me/cvenotify/64931 · Telegram Post