| Package | Affected versions | Patched versions |
|---|---|---|
| org.wso2.carbon.mediation:org.wso2.carbon.localentry | all versions | |
| api control plane | = 4.5.0 | |
| api manager | = 3.1.0= 3.2.0= 3.2.1= 4.0.0= 4.1.0= 4.2.0= 4.3.0= 4.4.0= 4.5.0 | |
| enterprise integrator | = 6.6.0 | |
| identity server | = 5.10.0= 5.11.0= 7.1.0 | |
| open banking am | = 2.0.0 | |
| open banking iam | = 2.0.0 | |
| traffic manager | = 4.5.0 | |
| universal gateway | = 4.5.0 |
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities.
A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free