CVE-2023-6836

MEDIUM

WSO2 API Manager < 3.0.0 - XML External Entity Injection

Title source: llm
STIX 2.1

Description

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

References (1)

Core 1

Scores

CVSS v3 4.6
EPSS 0.0045
EPSS Percentile 35.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Details

CWE
CWE-611
Status published
Products (20)
org.wso2.am/wso2am 0 - 4.0.0-betaMaven
org.wso2.carbon.analytics-common/org.wso2.carbon.event.input.adapter.core 0 - 5.2.23Maven
org.wso2.carbon.commons/org.wso2.carbon.ntask.core 0 - 4.7.24Maven
org.wso2.carbon.event-processing/org.wso2.carbon.event.processor.core 0 - 2.2.12Maven
org.wso2.carbon.governance/org.wso2.carbon.governance.common 0 - 4.8.13Maven
org.wso2.carbon.registry/org.wso2.carbon.registry.extensions 0 - 4.7.31Maven
wso2/api_manager < 3.0.0
wso2/api_manager_analytics 2.2.0
wso2/api_manager_analytics 2.5.0
wso2/api_microgateway 2.2.0
... and 10 more
Published Dec 15, 2023
Tracked Since Feb 18, 2026