CVE-2023-6838: XSS

Published Dec 15, 2023

Updated

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.

Affected Software

4 affected components

WSO2 API Manager=3.1.0

WSO2 API Manager=3.2.0

WSO2 Identity Server as Key Manager=5.10.0

WSO2 Identity Server=5.10.0

Remediation

Information

For WSO2 Subscription holders, the recommended solution is to apply the provided patch/update to the affected versions of the products. If there are any instructions given with the patch/update, please make sure those are followed properly. Community users may apply the relevant fixes to the product based on the public fix(s) advertised in https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1233/

Event History

Dec 15, 2023

CVE Published

09:50 AM

Data Sourced

09:50 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2023-6838?

CVE-2023-6838 has been classified as a reflected XSS vulnerability that can lead to significant security risks.

How do I fix CVE-2023-6838?

To fix CVE-2023-6838, update the affected WSO2 API Manager or WSO2 Identity Server software to the latest patched versions.

What systems are affected by CVE-2023-6838?

CVE-2023-6838 affects WSO2 API Manager versions 3.1.0 and 3.2.0, as well as WSO2 Identity Server versions 5.10.0.

How can CVE-2023-6838 be exploited?

CVE-2023-6838 can be exploited by manipulating request parameters in both authenticated and unauthenticated requests.

What are the potential impacts of CVE-2023-6838?

The potential impacts of CVE-2023-6838 include unauthorized access to user sessions and the execution of malicious scripts in user browsers.