PT-2023-32785 · Wso2 · Wso2

Publicado 2023-12-15 · Atualizado 2025-06-05 · CVE-2023-6837

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description The issue allows a malicious actor to perform user impersonation using JIT provisioning under specific conditions. These conditions include an IDP configured for federated authentication with JIT provisioning enabled and the "Prompt for username, password and consent" option, as well as a service provider using the IDP for federated authentication with the "Assert identity using mapped local subject identifier" flag enabled. The attacker must have a fresh valid user account in the federated IDP and knowledge of the username of a valid user in the local IDP.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-6837

GHSA-F6JM-9PR8-9C3W

Produtos afetados

Wso2

Referências · 11

• https://github.com/wso2/carbon-identity-framework/commit/fdab609760784086b8a3f55f7acf46d977a03d79 · Nota
• https://github.com/wso2/identity-apps/commit/1424203bbe81688d661ea8b8cd28e332302e1c53 · Nota
• https://twitter.com/VulmonFeeds/status/1735625229202808931 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6837 · Nota de Segurança
• https://twitter.com/CVEnew/status/1735598651848949859 · Publicação no Twitter
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1573 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-6837 · Aviso do Fabricante
• https://t.me/cvenotify/80095 · Publicação no Telegram
• https://t.me/cvenotify/66450 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-f6jm-9pr8-9c3w · Aviso do Fabricante
• https://t.me/cvenotify/124733 · Publicação no Telegram