Description
XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.
Remediation
References
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665
Related Vulnerabilities
CVE-2019-10289 Vulnerability in maven package org.jenkins-ci.plugins:netsparker-cloud-scan
CVE-2022-34806 Vulnerability in maven package org.jenkins-ci.plugins:jigomerge
CVE-2020-13956 Vulnerability in maven package org.apache.httpcomponents:httpclient
CVE-2020-1929 Vulnerability in maven package org.apache.beam:beam-sdks-java-io-mongodb
CVE-2021-21342 Vulnerability in maven package com.thoughtworks.xstream:xstream