QwikSec

Security Database

CVE

CWE

Training

CVE-2021-42646

Published: May 11, 2022

Modified: Aug 4, 2024

PUBLISHED

Description

XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/wso2/carbon-identity-framework/pull/3472

20220610 XML External Entity (XXE) vulnerability in the WSO2 Management Console

mailing-list

http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.