{"action":"Upgrade org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework to 5.20.254 or later.","affected":[{"fixed":"5.20.254","introduced":"0"}],"component":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework","cve_ids":["CVE-2023-6837"],"ecosystem":"Maven","epss":0.0046,"exploited":false,"fixed_versions":["5.20.254"],"ghsa_id":"GHSA-f6jm-9pr8-9c3w","id":"tcs_01M5N8V7R1A95XSTF674E5487A","modified_at":"2024-12-02T05:46:37.704358Z","published_at":"2023-12-15T12:30:25Z","references":["https://osv.dev/vulnerability/GHSA-f6jm-9pr8-9c3w","https://nvd.nist.gov/vuln/detail/CVE-2023-6837","https://github.com/wso2/carbon-identity-framework/commit/fdab609760784086b8a3f55f7acf46d977a03d79","https://github.com/wso2/identity-apps/commit/1424203bbe81688d661ea8b8cd28e332302e1c53","https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1573"],"severity":{"label":"high","score":8.5},"sources":[{"source":"osv","source_id":"GHSA-f6jm-9pr8-9c3w","url":"https://osv.dev/vulnerability/GHSA-f6jm-9pr8-9c3w"}],"summary":"Multiple WSO2 products vulnerable to perform user impersonatoin using JIT provisioning"}