Vulnerability CVE-2020-12719
Published: 2020-05-08

Description:
XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.

Type:

CWE-611

 (Information Exposure Through XML External Entity Reference)

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
6.5/10
6.4/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
WSO2 -> Api manager 
WSO2 -> Api manager analytics 
WSO2 -> Api microgateway 
WSO2 -> Enterprise integrator 
WSO2 -> Identity server 
WSO2 -> Identity server analytics 
WSO2 -> Identity server as key manager 

 References:
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665
Copyright 2024, cxsecurity.com

 

Back to Top