Description
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities.
A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WSO2 | WSO2 Enterprise Integrator | 6.6.0 – < 6.6.0.223 | 6.6.0.223 |
| WSO2 | WSO2 API Control Plane | 4.5.0 – < 4.5.0.27 | 4.5.0.27 |
| WSO2 | WSO2 Universal Gateway | 4.5.0 – < 4.5.0.25 | 4.5.0.25 |
| WSO2 | WSO2 Traffic Manager | 4.5.0 – < 4.5.0.25 | 4.5.0.25 |
| WSO2 | WSO2 API Manager | 3.1.0 – < 3.1.0.344, 3.2.0 – < 3.2.0.445, 3.2.1 – < 3.2.1.65, 4.0.0 – < 4.0.0.365, 4.1.0 – < 4.1.0.227, 4.2.0 – < 4.2.0.167, 4.3.0 – < 4.3.0.79, 4.4.0 – < 4.4.0.43, 4.5.0 – < 4.5.0.26 | 3.1.0.344 |
| WSO2 | WSO2 Identity Server | 5.10.0 – < 5.10.0.373, 5.11.0 – < 5.11.0.417, 7.1.0 – < 7.1.0.29 | 5.10.0.373 |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 – < 2.0.0.413 | 2.0.0.413 |
| WSO2 | WSO2 Open Banking AM | 2.0.0 – < 2.0.0.393 | 2.0.0.393 |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 – < 5.10.0.363 | 5.10.0.363 |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.localentry | 4.7.30 – < 4.7.30.46, 4.7.61 – < 4.7.61.61, 4.7.99 – < 4.7.99.303, 4.7.131 – < 4.7.131.21, 4.7.175 – < 4.7.175.29, 4.7.188 – < 4.7.188.11, 4.7.204 – < 4.7.204.12, 4.7.221 – < 4.7.221.6, 4.7.245 – < 4.7.245.6 | 4.7.30.46 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.wso2.carbon.mediation:org.wso2.carbon.localentry | all versions | — | GHSA-fvfq-q238-j7j3 |