CVE-2023-6835

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
WSO2	WSO2 API Manager	>= 2.2.0.0, < 2.2.0.16; >= 2.5.0.0, < 2.5.0.17; >= 2.6.0.0, < 2.6.0.24
WSO2	WSO2 IoT Server	>= 3.3.1.0, < 3.3.1.17

References

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68367.5Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely us CVE-2023-68378.2Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerabil CVE-2023-68386.1Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both auth CVE-2023-68395.3Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in th CVE-2023-68406.7An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 w CVE-2023-68417.5A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repe CVE-2023-68424.8The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stor CVE-2023-68434.3The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 d CVE-2023-68445.0The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to and includi CVE-2023-68458.8The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users CVE-2023-68468.8The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_chec CVE-2023-68477.5An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a special