01 Record

CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload

MediumPUBLISHEDCNA: WSO2

CNA base score4.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

View raw JSON

02 Description

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.41% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 33.7% of scored records. A rank, not a probability.
NVD base score: 4.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2023-12-18 08:32Z2 YR AGO

Last updated

2024-08-02 08:42Z2 YR AGO

Reserved

2023-12-18

Assigning CNA

WSO2

Record state

PUBLISHED

Severity

Medium (CVSS 4.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

Data version

5.1

Document digest

9cf0ce974a4ac712014e379f9b8d14d8d82164dc087de14afdb41c884f7134a5

05 Affected products

VendorProductVersionsPlatforms

WSO2WSO2 API Manager2.2.0.0 to < 2.2.0.1, 2.5.0.0 to < 2.5.0.1, 2.6.0.0 to < 2.6.0.1, 3.0.0.0 to < 3.0.0.1, 3.1.0.0 to < 3.1.0.1, 3.2.0.0 to < 3.2.0.1—

WSO2WSO2 API Manager Analytics2.2.0.0 to < 2.2.0.1, 2.5.0.0 to < 2.5.0.1—

WSO2WSO2 API Microgateway2.2.0.0 to < 2.2.0.1—

WSO2WSO2 Data Analytics Server3.2.0.0 to < 3.2.0.1—

WSO2WSO2 Enterprise Integrator6.1.0.0 to < 6.1.0.9, 6.1.1.0 to < 6.1.1.9, 6.2.0.0 to < 6.2.0.7, 6.3.0.0 to < 6.3.0.1, 6.4.0.0 to < 6.4.0.1, 6.5.0.0 to < 6.5.0.6, 6.6.0.0 to < 6.6.0.11—

WSO2WSO2 IS as Key Manager5.5.0.0 to < 5.5.0.1, 5.6.0.0 to < 5.6.0.1, 5.7.0.0 to < 5.7.0.1, 5.9.0.0 to < 5.9.0.1, 5.10.0.0 to < 5.10.0.1—

WSO2WSO2 Identity Server5.4.0.0 to < 5.4.0.4, 5.4.1.0 to < 5.4.1.3, 5.5.0.0 to < 5.5.0.1, 5.6.0.0 to < 5.6.0.1, 5.7.0.0 to < 5.7.0.1, 5.8.0.0 to < 5.8.0.5, 5.9.0.0 to < 5.9.0.1, 5.10.0.0 to < 5.10.0.1—

WSO2WSO2 Identity Server Analytics5.4.0.0 to < 5.4.0.2, 5.4.1.0 to < 5.4.1.2, 5.5.0.0 to < 5.5.0.1, 5.6.0.0 to < 5.6.0.1—

WSO2WSO2 Message Broker3.2.0.0 to < 3.2.0.3—

06 References

security.docs.wso2.comhttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/vendor-advisory

07 Remediation

For WSO2 Subscription holders, the recommended solution is to apply the provided patch/update to the affected versions of the products. If there are any instructions given with the patch/update, please make sure those are followed properly. Community users may apply the relevant fixes to the product based on the public fix(s) advertised in https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/

01 Record index

CVE-2023-6911

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation

02 Records

CVE-2023-6911

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation