PT-2023-8227 · Wso2 · Wso2

Published 2023-12-15 · Updated 2023-12-19 · CVE-2023-6836

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions WSO2 (affected versions not specified)

Description The issue is related to an XML External Entity (XXE) attack that abuses a feature of XML parsers to access sensitive information. This can allow a remote attacker to conduct XXE attacks. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the abuse of a widely available but rarely used feature of XML parsers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2024-00233

CVE-2023-6836

GHSA-CR8H-FR86-8VFV

Affected Products

Wso2

References · 14

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-0716 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6836 · Security Note
• https://osv.dev/vulnerability/GHSA-cr8h-fr86-8vfv · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00233 · Security Note
• https://github.com/wso2/product-apim/commit/96e8f5d6566d57bbbb8d4257f6f55057a79d00b5 · Note
• https://github.com/wso2/carbon-commons/commit/a08a587e3dd5146121a7b47a0fdd06ddbcd903f4 · Note
• https://github.com/wso2/carbon-analytics-common/commit/9478336859306d3ea13b25cb386f29c183707fde · Note
• https://github.com/wso2/carbon-registry/commit/738b2a0b3e5f118527da236467ed72d9fd9ce40e · Note
• https://github.com/wso2/carbon-event-processing/commit/e9953afd46a45f704de341a081f710cbdfa3f975 · Note
• https://github.com/wso2/carbon-governance/commit/ad36968d5a11d4fc35fa5cc4e8b5ae9a04e5bb4c · Note
• https://t.me/cvenotify/64119 · Telegram Post
• https://twitter.com/CVEnew/status/1735595105460138316 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1735624470398742663 · Twitter Post