Description

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

Remediation

References

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0742

Related Vulnerabilities

CVE-2021-21627 Vulnerability in maven package org.jenkins-ci.plugins:libvirt-slave

CVE-2019-10424 Vulnerability in maven package com.technicolor:eloyente

CVE-2007-4556 Vulnerability in maven package opensymphony:xwork

CVE-2020-2269 Vulnerability in maven package org.jenkins-ci.plugins:chosen-views-tabbar

CVE-2022-24785 Vulnerability in npm package moment

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Tags

Vendor Advisory CWE-776