{"id":"CVE-2023-6911","state":"PUBLISHED","title":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a ","description":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n","publishedAt":"2023-12-18T08:32:58.961Z","updatedAt":"2024-08-02T08:42:08.416Z","severity":{"score":4.8,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","source":"WSO2"},"assigner":"WSO2","products":["WSO2 WSO2 API Manager","WSO2 WSO2 API Manager Analytics","WSO2 WSO2 API Microgateway","WSO2 WSO2 Data Analytics Server","WSO2 WSO2 Enterprise Integrator","WSO2 WSO2 IS as Key Manager","WSO2 WSO2 Identity Server","WSO2 WSO2 Identity Server Analytics","WSO2 WSO2 Message Broker"],"affected":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0.0","versionType":"custom"},{"version":"2.2.0.0","status":"affected","lessThan":"2.2.0.1","versionType":"custom"},{"version":"2.5.0.0","status":"affected","lessThan":"2.5.0.1","versionType":"custom"},{"version":"2.6.0.0","status":"affected","lessThan":"2.6.0.1","versionType":"custom"},{"version":"3.0.0.0","status":"affected","lessThan":"3.0.0.1","versionType":"custom"},{"version":"3.1.0.0","status":"affected","lessThan":"3.1.0.1","versionType":"custom"},{"version":"3.2.0.0","status":"affected","lessThan":"3.2.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/product-apim"},{"vendor":"WSO2","product":"WSO2 API Manager Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0.0","versionType":"custom"},{"version":"2.2.0.0","status":"affected","lessThan":"2.2.0.1","versionType":"custom"},{"version":"2.5.0.0","status":"affected","lessThan":"2.5.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/analytics-apim"},{"vendor":"WSO2","product":"WSO2 API Microgateway","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0.0","versionType":"custom"},{"version":"2.2.0.0","status":"affected","lessThan":"2.2.0.1","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Data Analytics Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.2.0.0","versionType":"custom"},{"version":"3.2.0.0","status":"affected","lessThan":"3.2.0.1","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Integrator","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"6.1.0.0","versionType":"custom"},{"version":"6.1.0.0","status":"affected","lessThan":"6.1.0.9","versionType":"custom"},{"version":"6.1.1.0","status":"affected","lessThan":"6.1.1.9","versionType":"custom"},{"version":"6.2.0.0","status":"affected","lessThan":"6.2.0.7","versionType":"custom"},{"version":"6.3.0.0","status":"affected","lessThan":"6.3.0.1","versionType":"custom"},{"version":"6.4.0.0","status":"affected","lessThan":"6.4.0.1","versionType":"custom"},{"version":"6.5.0.0","status":"affected","lessThan":"6.5.0.6","versionType":"custom"},{"version":"6.6.0.0","status":"affected","lessThan":"6.6.0.11","versionType":"custom"}],"repo":"https://github.com/wso2/product-ei"},{"vendor":"WSO2","product":"WSO2 IS as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.5.0.0","versionType":"custom"},{"version":"5.5.0.0","status":"affected","lessThan":"5.5.0.1","versionType":"custom"},{"version":"5.6.0.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"},{"version":"5.7.0.0","status":"affected","lessThan":"5.7.0.1","versionType":"custom"},{"version":"5.9.0.0","status":"affected","lessThan":"5.9.0.1","versionType":"custom"},{"version":"5.10.0.0","status":"affected","lessThan":"5.10.0.1","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.4.0.0","versionType":"custom"},{"version":"5.4.0.0","status":"affected","lessThan":"5.4.0.4","versionType":"custom"},{"version":"5.4.1.0","status":"affected","lessThan":"5.4.1.3","versionType":"custom"},{"version":"5.5.0.0","status":"affected","lessThan":"5.5.0.1","versionType":"custom"},{"version":"5.6.0.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"},{"version":"5.7.0.0","status":"affected","lessThan":"5.7.0.1","versionType":"custom"},{"version":"5.8.0.0","status":"affected","lessThan":"5.8.0.5","versionType":"custom"},{"version":"5.9.0.0","status":"affected","lessThan":"5.9.0.1","versionType":"custom"},{"version":"5.10.0.0","status":"affected","lessThan":"5.10.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/product-is"},{"vendor":"WSO2","product":"WSO2 Identity Server Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.4.0.0","versionType":"custom"},{"version":"5.4.0.0","status":"affected","lessThan":"5.4.0.2","versionType":"custom"},{"version":"5.4.1.0","status":"affected","lessThan":"5.4.1.2","versionType":"custom"},{"version":"5.5.0.0","status":"affected","lessThan":"5.5.0.1","versionType":"custom"},{"version":"5.6.0.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/analytics-is"},{"vendor":"WSO2","product":"WSO2 Message Broker","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.2.0.0","versionType":"custom"},{"version":"3.2.0.0","status":"affected","lessThan":"3.2.0.3","versionType":"custom"}]}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/6xxx/CVE-2023-6911.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-6911","state":"PUBLISHED","datePublished":"2023-12-18T08:32:58.961Z","dateUpdated":"2024-08-02T08:42:08.416Z","assignerShortName":"WSO2","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateReserved":"2023-12-18T08:23:45.214Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n"}],"affected":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0.0","versionType":"custom"},{"version":"2.2.0.0","status":"affected","lessThan":"2.2.0.1","versionType":"custom"},{"version":"2.5.0.0","status":"affected","lessThan":"2.5.0.1","versionType":"custom"},{"version":"2.6.0.0","status":"affected","lessThan":"2.6.0.1","versionType":"custom"},{"version":"3.0.0.0","status":"affected","lessThan":"3.0.0.1","versionType":"custom"},{"version":"3.1.0.0","status":"affected","lessThan":"3.1.0.1","versionType":"custom"},{"version":"3.2.0.0","status":"affected","lessThan":"3.2.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/product-apim"},{"vendor":"WSO2","product":"WSO2 API Manager Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0.0","versionType":"custom"},{"version":"2.2.0.0","status":"affected","lessThan":"2.2.0.1","versionType":"custom"},{"version":"2.5.0.0","status":"affected","lessThan":"2.5.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/analytics-apim"},{"vendor":"WSO2","product":"WSO2 API Microgateway","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.2.0.0","versionType":"custom"},{"version":"2.2.0.0","status":"affected","lessThan":"2.2.0.1","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Data Analytics Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.2.0.0","versionType":"custom"},{"version":"3.2.0.0","status":"affected","lessThan":"3.2.0.1","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Enterprise Integrator","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"6.1.0.0","versionType":"custom"},{"version":"6.1.0.0","status":"affected","lessThan":"6.1.0.9","versionType":"custom"},{"version":"6.1.1.0","status":"affected","lessThan":"6.1.1.9","versionType":"custom"},{"version":"6.2.0.0","status":"affected","lessThan":"6.2.0.7","versionType":"custom"},{"version":"6.3.0.0","status":"affected","lessThan":"6.3.0.1","versionType":"custom"},{"version":"6.4.0.0","status":"affected","lessThan":"6.4.0.1","versionType":"custom"},{"version":"6.5.0.0","status":"affected","lessThan":"6.5.0.6","versionType":"custom"},{"version":"6.6.0.0","status":"affected","lessThan":"6.6.0.11","versionType":"custom"}],"repo":"https://github.com/wso2/product-ei"},{"vendor":"WSO2","product":"WSO2 IS as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.5.0.0","versionType":"custom"},{"version":"5.5.0.0","status":"affected","lessThan":"5.5.0.1","versionType":"custom"},{"version":"5.6.0.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"},{"version":"5.7.0.0","status":"affected","lessThan":"5.7.0.1","versionType":"custom"},{"version":"5.9.0.0","status":"affected","lessThan":"5.9.0.1","versionType":"custom"},{"version":"5.10.0.0","status":"affected","lessThan":"5.10.0.1","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.4.0.0","versionType":"custom"},{"version":"5.4.0.0","status":"affected","lessThan":"5.4.0.4","versionType":"custom"},{"version":"5.4.1.0","status":"affected","lessThan":"5.4.1.3","versionType":"custom"},{"version":"5.5.0.0","status":"affected","lessThan":"5.5.0.1","versionType":"custom"},{"version":"5.6.0.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"},{"version":"5.7.0.0","status":"affected","lessThan":"5.7.0.1","versionType":"custom"},{"version":"5.8.0.0","status":"affected","lessThan":"5.8.0.5","versionType":"custom"},{"version":"5.9.0.0","status":"affected","lessThan":"5.9.0.1","versionType":"custom"},{"version":"5.10.0.0","status":"affected","lessThan":"5.10.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/product-is"},{"vendor":"WSO2","product":"WSO2 Identity Server Analytics","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.4.0.0","versionType":"custom"},{"version":"5.4.0.0","status":"affected","lessThan":"5.4.0.2","versionType":"custom"},{"version":"5.4.1.0","status":"affected","lessThan":"5.4.1.2","versionType":"custom"},{"version":"5.5.0.0","status":"affected","lessThan":"5.5.0.1","versionType":"custom"},{"version":"5.6.0.0","status":"affected","lessThan":"5.6.0.1","versionType":"custom"}],"repo":"https://github.com/wso2/analytics-is"},{"vendor":"WSO2","product":"WSO2 Message Broker","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.2.0.0","versionType":"custom"},{"version":"3.2.0.0","status":"affected","lessThan":"3.2.0.3","versionType":"custom"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WSO2","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateUpdated":"2023-12-18T08:32:58.961Z"},"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"For WSO2 Subscription holders, the recommended solution is to apply the provided patch/update to the affected versions of the products. If there are any instructions given with the patch/update, please make sure those are followed properly.<br><br>Community users may apply the relevant fixes to the product based on the public fix(s) advertised in&nbsp;<a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1...</a><br>"}],"value":"For WSO2 Subscription holders, the recommended solution is to apply the provided patch/update to the affected versions of the products. If there are any instructions given with the patch/update, please make sure those are followed properly.\n\nCommunity users may apply the relevant fixes to the product based on the public fix(s) advertised in  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/ \n"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/","tags":["vendor-advisory","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:42:08.416Z"}}]}}}