VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 18, 2023· Updated Aug 2, 2024

CVE-2023-6911

CVE-2023-6911

Description

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.wso2.carbon.registry:carbon-registryMaven
< 4.7.374.7.37

Affected products

3

Patches

1
878fc7e53c90

Merge pull request #354 from hisanhunais/SECURITYINTERNAL-1225

https://github.com/wso2/carbon-registryVithursaJan 6, 2021via ghsa
commit
1 file changed · +4 −3
  • components/registry/org.wso2.carbon.registry.info.ui/src/main/resources/web/info/comment-delete-ajaxprocessor.jsp+4 −3 modified
    @@ -25,6 +25,7 @@
 <%@ page import="org.wso2.carbon.utils.ServerConstants" %>
 <%@ page import="org.wso2.carbon.registry.common.beans.CommentBean" %>
 <%@ page import="org.wso2.carbon.registry.common.beans.utils.Comment" %>
+<%@ page import="org.owasp.encoder.Encode" %>
 <carbon:jsi18n resourceBundle="org.wso2.carbon.registry.info.ui.i18n.JSResources"
 		request="<%=request%>" namespace="org.wso2.carbon.registry.info.ui" />
 <script type="text/javascript" src="../info/js/info.js"></script>
@@ -86,12 +87,12 @@
                             <a class="closeButton icon-link registryWriteOperation" onclick="delComment('<%=request.getParameter("path")%>','<%=commentPath%>')" id="closeC<%=i%>" title="<fmt:message key="delete"/>" style="background-image: url(../admin/images/delete.gif);position:relative;float:right">&nbsp;</a>
                             <% } %>
                             <fmt:message key="comment">
-                                <fmt:param value="<%=commentString%>"/>
+                                <fmt:param value="<%=Encode.forHtml(commentString)%>"/>
                             </fmt:message>
                             <br/>
                             <fmt:message key="posted.on.by">
-                                <fmt:param value="<%=commentedTime%>"/>
-                                <fmt:param value="<%=commentedUser%>"/>
+                                <fmt:param value="<%=Encode.forHtml(commentedTime)%>"/>
+                                <fmt:param value="<%=Encode.forHtml(commentedUser)%>"/>
                             </fmt:message>
                             <div style="clear:both;"></div>
                         </div>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.