XXE Vulnerability in WSO2 API Manager and WSO2 IS Key Manager Products
CVE-2020-13883

5.5MEDIUM

Key Information:

Vendor

Wso2

Status
Identity Server As Key Manager
Api Microgateway
Api Manager
Vendor
CVE Published:
6 June 2020

What is CVE-2020-13883?

A vulnerability exists in WSO2 API Manager and WSO2 IS Key Manager that allows for XML External Entity (XXE) injection through the Management Console. This vulnerability can occur during the addition or update of a Lifecycle, potentially leading to exposure of sensitive information or unauthorized access to system resources. It is crucial for users of the affected versions to apply the recommended patches or updates to mitigate any risks associated with this vulnerability.

References

https://docs.wso2.com/display/Security/Security+Advisory+...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2020-13883 : XXE Vulnerability in WSO2 API Manager and WSO2 IS Key Manager Products