GHSA-rfq3-wpjh-ppvg

WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-6911

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.wso2.carbon.registry:carbon-registry	< 4.7.37	4.7.37

Details

As written in the advisory (Markdown source, shown as plain text).

WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-6911 advisory
https://github.com/wso2/carbon-registry/commit/878fc7e53c90acc85e303d2af73440014a68b246 web
https://github.com/wso2/carbon-registry web
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225 web