WSO2 Vulnerabilities and Affected Products
Vulnerabilities associated with WSO2 API Manager Analytics.
Products
Clear product- WSO2 API Manager64 vulnerabilities
- WSO2 Identity Server59 vulnerabilities
- WSO2 Identity Server as Key Manager36 vulnerabilities
- WSO2 Open Banking IAM34 vulnerabilities
- WSO2 API Control Plane33 vulnerabilities
- WSO2 Open Banking AM30 vulnerabilities
- WSO2 Traffic Manager30 vulnerabilities
- WSO2 Universal Gateway29 vulnerabilities
- WSO2 Enterprise Integrator23 vulnerabilities
- WSO2 Open Banking KM8 vulnerabilities
- WSO2 Micro Integrator7 vulnerabilities
- WSO2 Carbon API Management Implementation5 vulnerabilities
- WSO2 Carbon API Manager Rest API Utility4 vulnerabilities
- WSO2 Enterprise Mobility Manager4 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.base3 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.ui3 vulnerabilities
- WSO2 Carbon Identity Application Authentication Framework3 vulnerabilities
- WSO2 Carbon MagicLink Authenticator Module3 vulnerabilities
- WSO2 Enterprise Service Bus3 vulnerabilities
- WSO2 IS as Key Manager3 vulnerabilities
- api_manager2 vulnerabilities
- carbon-registry2 vulnerabilities
- Email OTP Authenticator2 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.server.admin2 vulnerabilities
- WSO2 API Manager Analytics2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-6911MEDIUM | WSO2 Registry Stored Cross Site Scripting (XSS) vulnerabilityMultiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console. CWE-79Dec 18, 2023 | CVSS4.8v3.1 | EPSS0.406% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2023-6836MEDIUM | WSO2 products vulnerable to XML External Entity attackMultiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. CWE-611Dec 15, 2023 | CVSS4.6v3.1 | EPSS0.482% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |