Lucene search

[email protected]CVE-2020-12719

HistoryMay 08, 2020 - 12:15 a.m.

CVE-2020-12719

2020-05-0800:15:12

CWE-611

[email protected]

web.nvd.nist.gov

cve-2020-12719

xxe

wso2 api manager

api manager analytics

api microgateway

enterprise integrator

identity server

nvd

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.

Affected configurations

NVD

Node

wso2api_managerRange≤3.0.0

wso2api_manager_analyticsRange≤2.5.0

wso2api_microgatewayMatch2.2.0

wso2enterprise_integratorRange≤6.4.0

wso2identity_serverRange≤5.9.0

wso2identity_server_analyticsRange≤5.6.0

wso2identity_server_as_key_managerRange≤5.9.0

CPENameOperatorVersion
wso2:api_managerwso2 api managerle3.0.0
wso2:api_manager_analyticswso2 api manager analyticsle2.5.0
wso2:api_microgatewaywso2 api microgatewayeq2.2.0
wso2:enterprise_integratorwso2 enterprise integratorle6.4.0
wso2:identity_serverwso2 identity serverle5.9.0
wso2:identity_server_analyticswso2 identity server analyticsle5.6.0
wso2:identity_server_as_key_managerwso2 identity server as key managerle5.9.0

CPE	Name	Operator	Version
wso2:api_manager	wso2 api manager	le	3.0.0
wso2:api_manager_analytics	wso2 api manager analytics	le	2.5.0
wso2:api_microgateway	wso2 api microgateway	eq	2.2.0
wso2:enterprise_integrator	wso2 enterprise integrator	le	6.4.0
wso2:identity_server	wso2 identity server	le	5.9.0
wso2:identity_server_analytics	wso2 identity server analytics	le	5.6.0
wso2:identity_server_as_key_manager	wso2 identity server as key manager	le	5.9.0

References

docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for CVE-2020-12719

prion1 cvelist1 osv1 nvd1