Vulnerability CVE-2020-24591
Published: 2020-08-21

Description:
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.

Type:

CWE-776

CVSS2 => (AV:N/AC:L/Au:S/C:P/I:N/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.5/10
4.9/10
8/10
Exploit range
Attack complexity
Authentication
Remote
Low
Single time
Confidentiality impact
Integrity impact
Availability impact
Partial
None
Partial
Affected software
WSO2 -> Api manager 
WSO2 -> Api manager analytics 
WSO2 -> Api microgatewa 
WSO2 -> Enterprise integrator 
WSO2 -> Identity server analytics 

 References:
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728
Copyright 2024, cxsecurity.com

 

Back to Top