XML Entity Expansion Vulnerability in WSO2 API Manager and Microgateway
CVE-2020-24590

9.1CRITICAL

Key Information:

Vendor

Wso2

Status
Api Microgateway
Api Manager
Vendor
CVE Published:
21 August 2020

What is CVE-2020-24590?

The Management Console in WSO2 API Manager versions up to 3.1.0 and API Microgateway versions up to 2.2.0 is susceptible to XML Entity Expansion (XEE) attacks. This vulnerability can be exploited to cause denial of service and may lead to the disclosure of sensitive information, as attackers can manipulate the XML parser into processing large amounts of data, potentially overwhelming system resources.

References

https://docs.wso2.com/display/Security/Security+Advisory+...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.