Improper Error Handling in WSO2 Products Exposing Internal Package Names
CVE-2023-6839

5.3MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Vendor
CVE Published:
15 December 2023

What is CVE-2023-6839?

A vulnerability exists in WSO2 products that arises from improper error handling mechanisms. When a REST API resource encounters an error, it may inadvertently leak server-side error details that include sensitive internal WSO2 package names. This exposure could potentially aid malicious actors in identifying internal components and exploiting the system further. It is crucial for users to review error handling configurations and implement necessary security measures to mitigate the risks associated with this vulnerability.

Affected Version(s)

WSO2 API Manager 3.0.0.0 < 3.0.0.15

WSO2 API Manager 3.2.0.0 < 3.2.0.32

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.