CVE-2020-24591

2020-08-2120:15:11

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.

CPENameOperatorVersion
product-apimeq2.1.0-update1
product-apimeq2.1.0-update3
product-apimeq1.9.0-Beta-3
product-apimeq1.10.0-rc4
product-apimeq2.0.0
product-apimeq1.10.0-rc3
product-apimeq1.9.0
product-apimeqtest-tag-1.9.0-Alpha
product-apimeq1.9.0-M2
product-apimeq2.0.0-rc5

Name	Operator	Version
product-apim	eq	2.1.0-update1
product-apim	eq	2.1.0-update3
product-apim	eq	1.9.0-Beta-3
product-apim	eq	1.10.0-rc4
product-apim	eq	2.0.0
product-apim	eq	1.10.0-rc3
product-apim	eq	1.9.0
product-apim	eq	test-tag-1.9.0-Alpha
product-apim	eq	1.9.0-M2
product-apim	eq	2.0.0-rc5