PT-2023-8227 · Wso2 · Wso2

Publicado 2023-12-15 · Atualizado 2023-12-19 · CVE-2023-6836

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions WSO2 (affected versions not specified)

Description The issue is related to an XML External Entity (XXE) attack that abuses a feature of XML parsers to access sensitive information. This can allow a remote attacker to conduct XXE attacks. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the abuse of a widely available but rarely used feature of XML parsers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2024-00233

CVE-2023-6836

GHSA-CR8H-FR86-8VFV

Produtos afetados

Wso2

Referências · 14

• https://github.com/wso2/product-apim/commit/96e8f5d6566d57bbbb8d4257f6f55057a79d00b5 · Nota
• https://github.com/wso2/carbon-commons/commit/a08a587e3dd5146121a7b47a0fdd06ddbcd903f4 · Nota
• https://github.com/wso2/carbon-analytics-common/commit/9478336859306d3ea13b25cb386f29c183707fde · Nota
• https://github.com/wso2/carbon-registry/commit/738b2a0b3e5f118527da236467ed72d9fd9ce40e · Nota
• https://github.com/wso2/carbon-event-processing/commit/e9953afd46a45f704de341a081f710cbdfa3f975 · Nota
• https://github.com/wso2/carbon-governance/commit/ad36968d5a11d4fc35fa5cc4e8b5ae9a04e5bb4c · Nota
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-0716 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-6836 · Aviso do Fabricante
• https://t.me/cvenotify/64119 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1735595105460138316 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-6836 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1735624470398742663 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-cr8h-fr86-8vfv · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-00233 · Nota de Segurança