GitHub Advisoryadvisory · Maven

GHSA-cr8h-fr86-8vfv WSO2 products vulnerable to XML External Entity attack

MEDIUM Published 2023-12-15 Modified 2023-12-19 Official page ↗
Aliases
CVE-2023-6836
Ecosystem
Maven
Packages
org.wso2.carbon.commons:org.wso2.carbon.ntask.core, org.wso2.am:wso2am, org.wso2.carbon.registry:org.wso2.carbon.registry.extensions, org.wso2.carbon.event-processing:org.wso2.carbon.event.processor.core, org.wso2.carbon.analytics-common:org.wso2.carbon.event.input.adapter.core, org.wso2.carbon.governance:org.wso2.carbon.governance.common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-611
Reviewed
2023-12-19

Affected packages

• Maven org.wso2.carbon.commons:org.wso2.carbon.ntask.core: < 4.7.24 → fixed in 4.7.24 • Maven org.wso2.am:wso2am: < 4.0.0-beta → fixed in 4.0.0-beta • Maven org.wso2.carbon.registry:org.wso2.carbon.registry.extensions: < 4.7.31 → fixed in 4.7.31 • Maven org.wso2.carbon.event-processing:org.wso2.carbon.event.processor.core: < 2.2.12 → fixed in 2.2.12 • Maven org.wso2.carbon.analytics-common:org.wso2.carbon.event.input.adapter.core: < 5.2.23 → fixed in 5.2.23 • Maven org.wso2.carbon.governance:org.wso2.carbon.governance.common: < 4.8.13 → fixed in 4.8.13

Description

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

Related

Alias · CVE (1)

  • CVE-2023-6836 Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely… vulnerability

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References