Lucene search

[email protected]CVE-2020-24591

HistoryAug 21, 2020 - 8:15 p.m.

CVE-2020-24591

2020-08-2120:15:11

CWE-611

[email protected]

web.nvd.nist.gov

wso2

management console

xxe attacks

eventreceiver updates

api manager

api microgateway

enterprise integrator

identity server

nvd

cve-2020-24591

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

0.001 Low

EPSS

Percentile

42.9%

JSON

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.

Affected configurations

NVD

Node

wso2api_managerRange≤3.0.0

wso2api_manager_analyticsMatch2.2.0

wso2api_manager_analyticsMatch2.5.0

wso2api_microgatewayMatch2.2.0

wso2enterprise_integratorMatch6.2.0

wso2enterprise_integratorMatch6.3.0

wso2identity_server_analyticsRange≤5.6.0

CPENameOperatorVersion
wso2:api_managerwso2 api managerle3.0.0
wso2:api_manager_analyticswso2 api manager analyticseq2.2.0
wso2:api_manager_analyticswso2 api manager analyticseq2.5.0
wso2:api_microgatewaywso2 api microgatewayeq2.2.0
wso2:enterprise_integratorwso2 enterprise integratoreq6.2.0
wso2:enterprise_integratorwso2 enterprise integratoreq6.3.0
wso2:identity_server_analyticswso2 identity server analyticsle5.6.0

CPE	Name	Operator	Version
wso2:api_manager	wso2 api manager	le	3.0.0
wso2:api_manager_analytics	wso2 api manager analytics	eq	2.2.0
wso2:api_manager_analytics	wso2 api manager analytics	eq	2.5.0
wso2:api_microgateway	wso2 api microgateway	eq	2.2.0
wso2:enterprise_integrator	wso2 enterprise integrator	eq	6.2.0
wso2:enterprise_integrator	wso2 enterprise integrator	eq	6.3.0
wso2:identity_server_analytics	wso2 identity server analytics	le	5.6.0

References

docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728

5.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:N/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

0.001 Low

EPSS

Percentile

42.9%

JSON

Related for CVE-2020-24591

prion1 cvelist1 nvd1 osv1 veracode1