CVE-2023-6838

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
WSO2	WSO2 API Manager	>= 3.1.0.0, < 3.1.0.14; >= 3.2.0.0, < 3.2.0.10
WSO2	WSO2 Identity Server	>= 5.10.0.0, < 5.10.0.5
WSO2	WSO2 IS as Key Manager	>= 5.10.0.0, < 5.10.0.5

References

Timeline

Published: Dec 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-68395.3Due to improper error handling, a REST API resource could expose a server side error containing an internal WSO2 specific package name in th CVE-2023-68406.7An issue has been discovered in GitLab EE affecting all versions from 16.4 prior to 16.6.7, 16.7 prior to 16.7.5, and 16.8 prior to 16.8.2 w CVE-2023-68417.5A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repe CVE-2023-68424.8The Formidable Forms – Contact Form, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to Stor CVE-2023-68434.3The easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg WordPress plugin before 2.4.7 d CVE-2023-68445.0The iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to and includi CVE-2023-68458.8The CommentTweets WordPress plugin through 0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users CVE-2023-68468.8The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_chec CVE-2023-68477.5An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed a bypass of Private Mode by using a special CVE-2023-68489.8A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function c CVE-2023-68499.8A vulnerability was found in kalcaddle kodbox up to 1.48. It has been rated as critical. Affected by this issue is the function cover of the CVE-2023-68509.8A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been declared as critical. This vulnerability affects unknown code