XML Parser Vulnerability in WSO2 Products

CVE-2024-2374

What is CVE-2024-2374?

A serious vulnerability exists in the XML parsers of various WSO2 products due to improper handling of user-supplied XML data. This vulnerability allows cybercriminals to send specially crafted XML payloads that manipulate the parser, potentially leading to the resolution of external entities. By exploiting this flaw, attackers could read sensitive files from the server's file system and gain access to limited HTTP resources. Furthermore, the flaw could enable denial of service attacks by overloading server resources through recursive entity expansion or fetching excessively large external resources. It is crucial for users to review the security configurations of their WSO2 products to mitigate the risks associated with this vulnerability.

References