Description
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.
Remediation
References
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728
Related Vulnerabilities
CVE-2022-41248 Vulnerability in maven package org.jenkins-ci.plugins:bigpanda-jenkins
CVE-2022-36903 Vulnerability in maven package org.jenkins-ci.plugins:repository-connector
CVE-2022-34213 Vulnerability in maven package org.jenkins-ci.plugins:squashtm-publisher
CVE-2023-40337 Vulnerability in maven package org.jenkins-ci.plugins:cloudbees-folder
CVE-2014-3680 Vulnerability in maven package org.jenkins-ci.main:jenkins-core