Description (CNA)
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| WSO2 / WSO2 API Manager | affected 0 before 2.0.0; affected 2.1.0; affected 2.2.0; affected 2.5.0; affected 2.6.0; affected 3.0.0; affected 3.1.0; affected 4.0.0 before 4.0.0.311; affected 4.1.0 before 4.1.0.152; affected 4.2.0 before 4.2.0.122 |
| WSO2 / WSO2 Enterprise Integrator | unknown 0 before 6.0.0; affected 6.0.0; affected 6.1.0; affected 6.1.1; affected 6.2.0; affected 6.3.0; affected 6.4.0; affected 6.5.0; affected 6.6.0 |
| WSO2 / WSO2 Enterprise Service Bus | unknown 0 before 4.9.0; affected 4.9.0; affected 5.0.0 |
| WSO2 / WSO2 Micro integrator | unknown 0 before 1.0.0; affected 1.0.0; affected 1.1.0; affected 1.2.0 before 1.2.0.162; affected 4.0.0 before 4.0.0.132; affected 4.1.0 before 4.1.0.115; affected 4.2.0 before 4.2.0.112 |
| WSO2 / WSO2 Open Banking AM | unknown 0 before 1.5.0; affected 1.5.0 |
CWE
CWE-611
References
ADP enrichment
No English description supplied.
No references supplied.