Description
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.
Remediation
References
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728
Related Vulnerabilities
CVE-2020-36321 Vulnerability in maven package com.vaadin:flow-server
CVE-2017-8045 Vulnerability in maven package org.springframework.amqp:spring-amqp
CVE-2013-1965 Vulnerability in maven package org.apache.struts:struts2-showcase
CVE-2013-1879 Vulnerability in maven package activemq:activemq-core
CVE-2022-46682 Vulnerability in maven package org.jenkins-ci.plugins:plot