XML External Entity Vulnerability in WSO2 API Manager and Identity Server
CVE-2021-42646

9.1CRITICAL

Key Information:

Vendor: Wso2
Status: Api Manager; Identity Server; Identity Server As Key Manager
Vendor: CVE Published:; 11 May 2022

What is CVE-2021-42646?

The WSO2 API Manager and Identity Server are susceptible to an XML External Entity (XXE) vulnerability that exists in the file-based service provider creation feature within their Management Console. Attackers can exploit this vulnerability by sending crafted GET requests, which may lead to unauthorized access to sensitive information or result in a denial of service condition. This highlights a significant risk for organizations using these WSO2 products, as it allows for the potential extraction of confidential data from the server or interruption of service.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch