CVE-2023-6911 WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability
Attackers can inject malicious scripts into the WSO2 Management Console Registry, leading to stored XSS and potential session hijacking.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-6911?
CVE-2023-6911 is a medium-severity cross-site scripting vulnerability in Wso2 Api Manager, published on 18 Dec 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.
Weakness: CWE-79
Which versions are affected by CVE-2023-6911?
2 open source packages ship an affected version, including org.wso2.carbon.registry:carbon-registry. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
org.wso2.carbon.registry:carbon-registry Maven | All versions | 4.7.37 |
org.wso2.carbon.registry:carbon-registry Maven | All versions | 4.7.37 |
Products include Wso2 Api Manager, Wso2 Api Manager Analytics, Wso2 Api Microgateway, Wso2 Data Analytics Server, Wso2 Enterprise Integrator, Wso2 Identity Server and 3 more.
How do I fix CVE-2023-6911?
Upgrade org.wso2.carbon.registry:carbon-registry to 4.7.37 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-6911 being exploited?
There is no known exploitation of CVE-2023-6911 in the wild and no public exploit code.
Other vulnerabilities in Wso2 Api Manager
- CVE-2022-29464 WSO2 Multiple Products Unrestrictive Upload of File
- CVE-2024-6914 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- CVE-2020-13226 WSO2 API Manager vulnerable to SSRF
- CVE-2025-2905 An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
- CVE-2021-42646 XML external entity in n/a
Sources
Also known as GHSA-rfq3-wpjh-ppvg.