Description
XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.
Remediation
References
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665
Related Vulnerabilities
CVE-2022-22984 Vulnerability in npm package @snyk/snyk-hex-plugin
CVE-2023-24457 Vulnerability in maven package org.jenkins-ci.plugins:keycloak
CVE-2023-33946 Vulnerability in maven package com.liferay.portal:release.portal.bom
CVE-2022-25312 Vulnerability in maven package org.apache.any23:apache-any23
CVE-2022-36905 Vulnerability in maven package eu.markov.jenkins.plugin.mvnmeta:maven-metadata-plugin