Input Validation Flaw in WSO2 Forum Feature Compromises API Integrity
CVE-2023-6835

4.3MEDIUM

Key Information:

Vendor

WSO2

Status
WSO2 API Manager
WSO2 IoT Server
Vendor
CVE Published:
15 December 2023

What is CVE-2023-6835?

Multiple WSO2 products exhibit a vulnerability attributable to insufficient server-side input validation within the Forum feature. This weakness enables potential attackers to manipulate API ratings, challenging the integrity and security of the application. Organizations using these products are urged to apply available patches and follow best practices to mitigate the risk associated with this vulnerability.

Affected Version(s)

WSO2 API Manager 2.2.0.0 < 2.2.0.16

WSO2 API Manager 2.5.0.0 < 2.5.0.17

WSO2 API Manager 2.6.0.0 < 2.6.0.24

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.