GHSA-rfq3-wpjh-ppvg

ghsaUSosv

WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability

view advisory published 2023-12-22Licence: CC-BY-4.0

WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-6911US	medium4.8	0.41% (35th)	—	2023-12-18
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a…

references

External citations — patches, advisories, analysis.

https://github.com/wso2/carbon-registryWEB
https://github.com/wso2/carbon-registry/commit/878fc7e53c90acc85e303d2af73440014a68b246WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-6911ADVISORY
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan