Code injection

2020-05-0800:15:00

PRIOn knowledge base

www.prio-n.com

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

42.9%

JSON

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.

CPENameOperatorVersion
api_managerle3.0.0
api_manager_analyticsle2.5.0
api_microgatewayeq2.2.0
enterprise_integratorle6.4.0
identity_serverle5.9.0
identity_server_analyticsle5.6.0
identity_server_as_key_managerle5.9.0

Name	Operator	Version
api_manager	le	3.0.0
api_manager_analytics	le	2.5.0
api_microgateway	eq	2.2.0
enterprise_integrator	le	6.4.0
identity_server	le	5.9.0
identity_server_analytics	le	5.6.0
identity_server_as_key_manager	le	5.9.0

References

docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665