← Back

CVE-2023-6836

nvd nist
Published: Dec 15, 2023Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

Affected (14)

Wso2
7 products
Api Manager
Api Manager Analytics
Api Microgateway
Enterprise Integrator
Identity Server As Key Manager
Identity Server
Micro Integrator
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Api Manager
Up to 3.0.0
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Wso2
Api Manager Analytics
Version 2.2.0
Api Manager Analytics
Version 2.5.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Api Microgateway
Version 2.2.0
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Enterprise Integrator
Up to 6.6.0
Configuration E
4 vulnerable
Vulnerable SoftwareAffected Versions
Wso2
Identity Server As Key Manager
Version 5.0.0
Identity Server As Key Manager
Version 5.6.0
Identity Server As Key Manager
Version 5.7.0
Identity Server As Key Manager
Version 5.9.0
Configuration F
4 vulnerable
Vulnerable SoftwareAffected Versions
Wso2
Identity Server
Version 5.4.0
Identity Server
Version 5.4.1
Identity Server
Version 5.5.0
Identity Server
Version 5.6.0
Configuration G
1 vulnerable
Vulnerable SoftwareAffected Versions
Micro Integrator
Version 1.0.0

Related CWEs

CWE-611
Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.