| Package | Affected versions | Patched versions |
|---|---|---|
| org.wso2.carbon.registry:carbon-registry | < 4.7.37 | 4.7.37 |
| api manager | = 2.2.0= 2.5.0= 2.6.0= 3.0.0= 3.1.0= 3.2.0 | |
| api manager analytics | = 2.2.0= 2.5.0 | |
| api microgateway | = 2.2.0 | |
| data analytics server | = 3.2.0 | |
| enterprise integrator | = 6.1.0= 6.1.1= 6.2.0= 6.3.0= 6.4.0= 6.5.0= 6.6.0 | |
| identity server | = 5.10.0= 5.4.0= 5.4.1= 5.5.0= 5.6.0= 5.7.0= 5.8.0= 5.9.0 | |
| identity server analytics | = 5.4.0= 5.4.1= 5.5.0= 5.6.0 | |
| identity server as key manager | = 5.10.0= 5.5.0= 5.6.0= 5.7.0= 5.9.0 | |
| message broker | = 3.2.0 |
WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free