Vulnerability · Published Dec 15, 2023 · Assigned by WSO2
CVE-2023-6838
Medium 6.1
In plain English
A medium-severity cross-site scripting in WSO2 API Manager from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.4%top 62.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 3.1.0.0 – before 3.1.0.143.2.0.0 – before 3.2.0.10 |
| WSO2 | WSO2 Identity Server | 5.10.0.0 – before 5.10.0.5 |
| WSO2 | WSO2 IS as Key Manager | 5.10.0.0 – before 5.10.0.5 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N