{"id":"CVE-2023-6911","aliases":["EUVD-2023-3289","GHSA-rfq3-wpjh-ppvg"],"status":"published","title":"WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability","description":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00406,"percentile":0.35157,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-12-18T08:32:58Z","modified":"2026-10-24T10:30:22Z","fixes":[{"ecosystem":"Maven","package":"org.wso2.carbon.registry:carbon-registry","fixed_in":["4.7.37"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.wso2.carbon.registry:carbon-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.37"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.wso2.carbon.registry:carbon-registry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.37"}]}],"versions":["4.6.11","4.6.12","4.6.13","4.6.14","4.6.15","4.6.16","4.6.17","4.6.18","4.6.19","4.6.20","4.6.21","4.6.22","4.6.23","4.6.24","4.6.25","4.6.26","4.6.27","4.6.28","4.6.29","4.6.30","4.6.31","4.6.32","4.6.33","4.6.34","4.6.35","4.6.36","4.6.37","4.6.38","4.6.39","4.6.40","4.6.41","4.6.42","4.7.13","4.7.14","4.7.15","4.7.16","4.7.17","4.7.25","4.7.26","4.7.27","4.7.28","4.7.31","4.7.32","4.7.33","4.7.34","4.7.35","4.7.36"]}],"products":[{"vendor":"wso2","product":"api_manager"},{"vendor":"wso2","product":"api_manager_analytics"},{"vendor":"wso2","product":"api_microgateway"},{"vendor":"wso2","product":"data_analytics_server"},{"vendor":"wso2","product":"enterprise_integrator"},{"vendor":"wso2","product":"identity_server"},{"vendor":"wso2","product":"identity_server_analytics"},{"vendor":"wso2","product":"identity_server_as_key_manager"},{"vendor":"wso2","product":"message_broker"},{"vendor":"wso2","product":"wso2 api manager"},{"vendor":"wso2","product":"wso2 api manager analytics"},{"vendor":"wso2","product":"wso2 api microgateway"},{"vendor":"wso2","product":"wso2 data analytics server"},{"vendor":"wso2","product":"wso2 enterprise integrator"},{"vendor":"wso2","product":"wso2 identity server"},{"vendor":"wso2","product":"wso2 identity server analytics"},{"vendor":"wso2","product":"wso2 is as key manager"},{"vendor":"wso2","product":"wso2 message broker"}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225/","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6911","tags":["advisory"]},{"url":"https://github.com/wso2/carbon-registry/commit/878fc7e53c90acc85e303d2af73440014a68b246","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rfq3-wpjh-ppvg"},{"url":"https://github.com/wso2/carbon-registry","tags":["web"]},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-6911","description":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n","status":"published","published":"2023-12-18T08:32:58.961Z","modified":"2024-08-02T08:42:08.416Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-3289","description":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n","status":"published","published":"2023-12-18T08:32:58Z","modified":"2024-08-02T08:42:08Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:10.17189Z"}],"ghsa":[{"id":"GHSA-rfq3-wpjh-ppvg","title":"WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability","description":"WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n","status":"published","published":"2023-12-22T18:30:30Z","modified":"2023-12-22T21:31:02Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:28.04129Z"}],"nvd":[{"id":"CVE-2023-6911","description":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n","status":"published","published":"2023-12-18T09:15:05.81Z","modified":"2026-06-17T06:51:40.133Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:56.329586Z"}],"osv":[{"id":"CVE-2023-6911","description":"Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n","status":"published","published":"2023-12-18T09:15:05.81Z","modified":"2026-10-24T10:30:22.362645427Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"GHSA-rfq3-wpjh-ppvg","title":"WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability","description":"WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.\n","status":"published","published":"2023-12-22T18:30:30Z","modified":"2024-02-16T08:11:33.398904Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}