CVE-2023-6836: XEE

Q: What is the severity of CVE-2023-6836?

CVE-2023-6836 has been classified with a high severity due to its potential for XML External Entity (XXE) attacks that can lead to the exposure of sensitive information.

Q: How do I fix CVE-2023-6836?

To remediate CVE-2023-6836, update the affected WSO2 products to the specified fixed versions mentioned in the advisory.

Q: Which WSO2 products are affected by CVE-2023-6836?

CVE-2023-6836 affects multiple WSO2 products including but not limited to WSO2 API Manager, WSO2 Identity Server, and WSO2 Enterprise Integrator.

Q: What type of attack is exploited in CVE-2023-6836?

CVE-2023-6836 exploits an XML External Entity (XXE) vulnerability that allows attackers to access sensitive data.

Q: Can CVE-2023-6836 lead to unauthorized data access?

Yes, CVE-2023-6836 can lead to unauthorized access to sensitive information by leveraging the XXE vulnerability.

Published Dec 15, 2023

Updated

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

Affected Software

20 affected componentsFixes available

maven/org.wso2.carbon.governance:org.wso2.carbon.governance.common<4.8.13

4.8.13

maven/org.wso2.carbon.analytics-common:org.wso2.carbon.event.input.adapter.core<5.2.23

5.2.23

maven/org.wso2.carbon.event-processing:org.wso2.carbon.event.processor.core<2.2.12

2.2.12

maven/org.wso2.carbon.registry:org.wso2.carbon.registry.extensions<4.7.31

4.7.31

maven/org.wso2.am:wso2am<4.0.0-beta

4.0.0-beta

maven/org.wso2.carbon.commons:org.wso2.carbon.ntask.core<4.7.24

4.7.24

WSO2 API Manager<=3.0.0

WSO2 API Manager Analytics=2.2.0

WSO2 API Manager Analytics=2.5.0

WSO2 API Microgateway=2.2.0

WSO2 Enterprise Integrator<=6.6.0

WSO2 Identity Server as Key Manager=5.0.0

WSO2 Identity Server as Key Manager=5.6.0

WSO2 Identity Server as Key Manager=5.7.0

WSO2 Identity Server as Key Manager=5.9.0

WSO2 Identity Server=5.4.0

WSO2 Identity Server=5.4.1

WSO2 Identity Server=5.5.0

WSO2 Identity Server=5.6.0

WSO2 Micro Integrator=1.0.0

Remediation

Information

For WSO2 Subscription holders, the recommended solution is to apply the provided patch/update to the affected versions of the products. If there are any instructions given with the patch/update, please make sure those are followed properly. Community users may apply the relevant fixes to the product based on the public fix(s) advertised in https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-0716/ https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-0716/

Event History

Dec 15, 2023

CVE Published

via MITRE·09:26 AM

Data Sourced

via MITRE·09:26 AM

RemedyDescriptionSeverityWeakness

Advisory Published

12:30 PM

Frequently Asked Questions

What is the severity of CVE-2023-6836?

CVE-2023-6836 has been classified with a high severity due to its potential for XML External Entity (XXE) attacks that can lead to the exposure of sensitive information.

How do I fix CVE-2023-6836?

To remediate CVE-2023-6836, update the affected WSO2 products to the specified fixed versions mentioned in the advisory.

Which WSO2 products are affected by CVE-2023-6836?