CVE-2023-6835 is a medium-severity (CVSS 5.3) Improper Input Validation vulnerability in org.wso2.carbon.apimgt:forum. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
WSO2 API Manager allows attackers to change the API rating
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
org.wso2.carbon.apimgt:forumReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | org.wso2.carbon.apimgt:forum | all versions | No fix |
Affected Products
api managerwso2iot serverwso2Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.wso2.carbon.apimgt:forum, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of org.wso2.carbon.apimgt:forum for CVE-2023-6835. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2023-6835 in your dependencies?
Find it across Maven, including transitive dependencies.