01 Record

CVE-2023-6837

Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation

HighPUBLISHEDCNA: WSO2

CNA base score8.5 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

View raw JSON

02 Description

Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.46% probability of exploitation activity in the next 30 days.
EPSS percentile: Ranks above 37.9% of scored records. A rank, not a probability.
NVD base score: 8.2 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2023-12-15 09:41Z2 YR AGO

Last updated

2025-09-25 14:59Z11 MO AGO

Reserved

2023-12-15

Assigning CNA

WSO2

Record state

PUBLISHED

Severity

High (CVSS 8.5)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weaknesses

CWE-863Incorrect AuthorizationClass

Data version

5.1

Document digest

64f3864362b581794adf9cd7628b1830f6726e7b904d01e0520ba6972deadff3

05 Affected products

VendorProductVersionsPlatforms

WSO2WSO2 API Manager2.5.0 to < 2.5.0.32, 2.6.0 to < 2.6.0.52, 3.0.0 to < 3.0.0.50, 3.1.0 to < 3.1.0.72, 3.2.0 to < 3.2.0.86, 4.0.0 to < 4.0.0.35—

WSO2WSO2 Identity Server5.6.0 to < 5.6.0.16, 5.7.0 to < 5.7.0.35, 5.8.0 to < 5.8.0.26, 5.9.0 to < 5.9.0.38, 5.10.0 to < 5.10.0.78, 5.11.0 to < 5.11.0.69—

WSO2WSO2 Identity Server as Key Manager5.6.0 to < 5.6.0.17, 5.7.0 to < 5.7.0.39, 5.9.0 to < 5.9.0.45, 5.10.0 to < 5.10.0.80—

WSO2WSO2 Carbon Identity Application Authentication Framework5.11.256 to < 5.11.256.3, 5.12.153 to < 5.12.153.21, 5.12.387 to < 5.12.387.7, 5.14.97 to < 5.14.97.22, 5.17.5 to < 5.17.5.106, 5.18.187 to < 5.18.187.76—

06 References

security.docs.wso2.comhttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1573/vendor-advisory

07 Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1... https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1573/#solution

01 Record index

CVE-2023-6837

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation

02 Records

CVE-2023-6837

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

07 Remediation