NetSight
IP …
critical9.1

CVE-2021-42646

XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, …

Impact

XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests.

Affected products

VendorProductAffected versions
Wso2Api Manager
Versions 2.6.0, 3.0.0, 3.1.0, 3.2.0, 4.0.0
Wso2Identity Server
Versions 5.7.0, 5.8.0, 5.9.0, 5.10.0, 5.11.0
Wso2Identity Server As Key Manager
Versions 5.7.0, 5.9.0, 5.10.0

Weakness classification

CWE-611

References