Description
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references.
By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 API Manager | 3.2.0 – < 3.2.0.397, 3.2.1 – < 3.2.1.27, 4.0.0 – < 4.0.0.310, 4.0.0 – < 4.0.0.319, 4.1.0 – < 4.1.0.171, 4.2.0 – < 4.2.0.127, 4.3.0 – < 4.3.0.39 | 3.2.0.397 |