What is CVE-2020-24591?

CVE-2020-24591 is a medium-severity vulnerability in Wso2 Api_manager, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2020-08-21.

How severe is CVE-2020-24591?

Medium severity. CVSS v3 base score is 6.5 out of 10.

XXE in Wso2 Api_manager

CVE-2020-24591

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.010 (60.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H.

Affected products

Wso2 Api_manager
Wso2 Api_manager_analytics — versions 2.2.0, 2.5.0
Wso2 Api_microgateway — versions 2.2.0
Wso2 Enterprise_integrator — versions 6.2.0, 6.3.0
Wso2 Identity_server_analytics
N/a — versions n/a

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-24591?: CVE-2020-24591 is a medium-severity vulnerability in Wso2 Api_manager, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 6.5/10. Published 2020-08-21.
How severe is CVE-2020-24591?: Medium severity. CVSS v3 base score is 6.5 out of 10.