WSO2 API Manager allows attackers to change the API rating

MITTEL 5.3CVE-2023-6835 · GHSA-w7rx-824v-rgx5 · Published 15/12/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-6835 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in org.wso2.carbon.apimgt:forum, api manager (wso2), iot server (wso2).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.52%, höher als bei 44.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
org.wso2.carbon.apimgt:forum Maven	`≤ 9.0.78`	No fix yet
api manager wso2	`= 2.2.0= 2.5.0= 2.6.0`	No fix yet
iot server wso2	`= 3.3.1`	No fix yet

Description

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

NVD description

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

References

nvd.nist.gov/vuln/detail/CVE-2023-6835 · ADVISORY
wso2/carbon-apimgt commit 2e9591b · WEB
wso2/carbon-apimgt · PACKAGE
wso2/carbon-apimgt · WEB
security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357 · WEB
security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1357 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free