VYPR
Moderate severityNVD Advisory· Published Dec 15, 2023· Updated Aug 2, 2024

CVE-2023-6835

CVE-2023-6835

Description

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.wso2.carbon.apimgt:forumMaven
<= 9.0.78

Affected products

1

Patches

1
2e9591b72bc2

Merge pull request #10471 from isharac/6x

https://github.com/wso2/carbon-apimgtIsharaAug 26, 2021via ghsa
1 file changed · +3 0
  • components/forum/org.wso2.carbon.forum/src/main/java/org/wso2/carbon/forum/registry/RegistryForumManager.java+3 0 modified
    @@ -763,6 +763,9 @@ public float rateTopic(String topicId, int rating, String username, String tenan
             Registry registry;
     
             try {
    +            final int MAX_RATE = 5;
    +            final int MIN_RATE = 1;
    +            rating = (rating > MAX_RATE) ? MAX_RATE : ((rating < MIN_RATE) ? MIN_RATE : rating);
                 registry = getRegistry(username, tenantDomain);
                 GenericArtifactManager artifactManager = getArtifactManager(registry, TOPIC_RXT_KEY);
                 GenericArtifact genericArtifact = artifactManager.getGenericArtifact(topicId);
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.