Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.2.0.1, 2.5.0.1, 2.6.0.1, 3.0.0.1, 3.1.0.1, and 20 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.
Timeline
- CVE published
- Record last updated
Affected versions
- WSO2 WSO2 API Manager
From 2.2.0.0 · fixed in 2.2.0.1; From 2.5.0.0 · fixed in 2.5.0.1; From 2.6.0.0 · fixed in 2.6.0.1; From 3.0.0.0 · fixed in 3.0.0.1; From 3.1.0.0 · fixed in 3.1.0.1; From 3.2.0.0 · fixed in 3.2.0.1
- WSO2 WSO2 API Manager Analytics
From 2.2.0.0 · fixed in 2.2.0.1; From 2.5.0.0 · fixed in 2.5.0.1
- WSO2 WSO2 API Microgateway
From 2.2.0.0 · fixed in 2.2.0.1
- WSO2 WSO2 Data Analytics Server
From 3.2.0.0 · fixed in 3.2.0.1
- WSO2 WSO2 Enterprise Integrator
From 6.1.0.0 · fixed in 6.1.0.9; From 6.1.1.0 · fixed in 6.1.1.9; From 6.2.0.0 · fixed in 6.2.0.7; From 6.3.0.0 · fixed in 6.3.0.1; From 6.4.0.0 · fixed in 6.4.0.1; From 6.5.0.0 · fixed in 6.5.0.6; From 6.6.0.0 · fixed in 6.6.0.11
- WSO2 WSO2 IS as Key Manager
From 5.5.0.0 · fixed in 5.5.0.1; From 5.6.0.0 · fixed in 5.6.0.1; From 5.7.0.0 · fixed in 5.7.0.1; From 5.9.0.0 · fixed in 5.9.0.1; From 5.10.0.0 · fixed in 5.10.0.1
- WSO2 WSO2 Identity Server
From 5.4.0.0 · fixed in 5.4.0.4; From 5.4.1.0 · fixed in 5.4.1.3; From 5.5.0.0 · fixed in 5.5.0.1; From 5.6.0.0 · fixed in 5.6.0.1; From 5.7.0.0 · fixed in 5.7.0.1; From 5.8.0.0 · fixed in 5.8.0.5; From 5.9.0.0 · fixed in 5.9.0.1; From 5.10.0.0 · fixed in 5.10.0.1
- WSO2 WSO2 Identity Server Analytics
From 5.4.0.0 · fixed in 5.4.0.2; From 5.4.1.0 · fixed in 5.4.1.2; From 5.5.0.0 · fixed in 5.5.0.1; From 5.6.0.0 · fixed in 5.6.0.1
- WSO2 WSO2 Message Broker
From 3.2.0.0 · fixed in 3.2.0.3
- org.wso2.carbon.registry:carbon-registryMaven
fixed in 4.7.37