CVE-2020-24591

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates

Medium · published August 21, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
63.5
In the wild
Unconfirmed
What it is

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:N/PR:H/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.01033 · 63.5th percentile
Published
2020-08-21T19:05Z
EPSS history
Timeline
  • 21 AUG 19:05Z
    The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates
    cvelistv5