{"id":"CVE-2023-6838","details":"Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.\n\n","modified":"2026-10-15T02:49:33.102975952Z","published":"2023-12-15T10:15:10Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"5.10.0"},{"last_affected":"5.10.0"}],"source":"CPE_STRING"}],"vendor_product":"wso2:identity_server","cpes":["cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"5.10.0"},{"last_affected":"5.10.0"}],"source":"CPE_STRING"}],"vendor_product":"wso2:identity_server_as_key_manager"}]},"references":[{"type":"ADVISORY","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1233/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wso2/product-apim","events":[{"introduced":"2971de274564b622974de831403e9688a4a76c14"},{"last_affected":"e4956e9301b1c26eb06e80ec5c86628154b6ab55"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*","range":[{"introduced":"3.1.0"},{"last_affected":"3.1.0"}],"source":"CPE_STRING"},{"range":[{"introduced":"3.2.0"},{"last_affected":"3.2.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*"}]}}],"versions":["3.1.0","3.2.0","v3.2.0-rc6","v3.2.0","v3.2.0-rc5","v3.2.0-rc4","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","v3.2.0-beta","v3.2.0-alpha","v3.2.0-m1","v3.1.0-rc3","v3.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-6838.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}