Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
CVE-2023-6838 Details
Description
Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1233/ | CVE | Vendor Advisory |
| https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1233/ | WSO2 LLC | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | WSO2 LLC |
Affected Products
| Product | Versions |
|---|---|
| wso2 api manager | 3.1.0 3.2.0 |
CPE
Remediation
| |
| wso2 identity server as key manager | 5.10.0 |
CPE
Remediation
| |
| wso2 identity server | 5.10.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | WSO2 LLC |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | WSO2 LLC |
| Dec 19, 2023 | Initial Analysis | [email protected] |
| Dec 15, 2023 | New CVE Received | WSO2 LLC |