Vulnerability · Published Dec 15, 2023 · Assigned by WSO2
CVE-2023-6835
Medium 4.3
In plain English
A medium-severity improper input validation in WSO2 API Manager from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.5%top 55.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.wso2.carbon.apimgt:forum | no fix listed | GHSA-w7rx-824v-rgx5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 2.2.0.0 – before 2.2.0.162.5.0.0 – before 2.5.0.172.6.0.0 – before 2.6.0.24 |
| WSO2 | WSO2 IoT Server | 3.3.1.0 – before 3.3.1.17 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N