CVE-2020-24590

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks.

Recent assessments:

krzysztof-przybylski at August 29, 2020 11:16pm UTC reported:

Severity: Critical
CVSS Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

AFFECTED PRODUCTS
WSO2 API Manager : 3.1.0 or earlier
WSO2 API Microgateway : 2.2.0

An XML External Entity injection (XXE) often allows an attacker to view files on the server file system, and to interact with any backend or external systems that the application itself can access and allows the attacker to transmit sensitive data from the compromised server to a system that the attacker controls. An XML Entity Expansion attack might result in a denial-of-service condition, causing the entire application to stop functioning. It is possible to exploit both of the above vulnerabilities without authenticating to the Management Console.

CREDITS
Krzysztof Przybylski

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 4