{"id":"CVE-2023-6838","details":"Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.\n\n","modified":"2026-07-08T07:47:10.210311715Z","published":"2023-12-15T10:15:10Z","database_specific":{"unresolved_ranges":[{"vendor_product":"wso2:identity_server","cpes":["cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.10.0"},{"last_affected":"5.10.0"}],"source":"CPE_STRING"},{"cpes":["cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5.10.0"},{"last_affected":"5.10.0"}],"source":"CPE_STRING","vendor_product":"wso2:identity_server_as_key_manager"}]},"references":[{"type":"ADVISORY","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1233/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wso2/product-apim","events":[{"introduced":"2971de274564b622974de831403e9688a4a76c14"},{"last_affected":"e4956e9301b1c26eb06e80ec5c86628154b6ab55"}],"database_specific":{"cpe":["cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*","cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.1.0"},{"last_affected":"3.1.0"},{"introduced":"3.2.0"},{"last_affected":"3.2.0"}],"source":"CPE_STRING"}}],"versions":["3.1.0","3.2.0","v3.2.0-rc6","v3.2.0","v3.2.0-rc5","v3.2.0-rc4","v3.2.0-rc3","v3.2.0-rc2","v3.2.0-rc1","v3.2.0-beta","v3.2.0-alpha","v3.2.0-m1","v3.1.0-rc3","v3.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-6838.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}