CVE-2020-24591

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.

CVSS v3 6.5 MEDIUM
CVSS v2.0 5.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:api_manager::::::::
	cpe:2.3:a:wso2:api_manager_analytics:2.2.0:::::::*
	cpe:2.3:a:wso2:api_manager_analytics:2.5.0:::::::*
	cpe:2.3:a:wso2:api_microgateway:2.2.0:::::::*
	cpe:2.3:a:wso2:enterprise_integrator:6.2.0:::::::*
	cpe:2.3:a:wso2:enterprise_integrator:6.3.0:::::::*
	cpe:2.3:a:wso2:identity_server_analytics::::::::

History

19 Apr 2022, 18:28

Type	Values Removed	Values Added
CPE	cpe:2.3:a:wso2:api_microgatewa:2.2.0:::::::*	cpe:2.3:a:wso2:api_microgateway:2.2.0:::::::*
CWE	~~CWE-776~~	CWE-611

Information

Published : 2020-08-21 20:15

Updated : 2024-02-04 21:00

NVD link : CVE-2020-24591

Mitre link : CVE-2020-24591

CVE.ORG link : CVE-2020-24591

JSON object : View

Products Affected

wso2

api_manager_analytics
api_microgateway
identity_server_analytics
enterprise_integrator
api_manager

CWE

CWE-611

Improper Restriction of XML External Entity Reference

{"id": "CVE-2020-24591", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.2}]}, "published": "2020-08-21T20:15:11.093", "references": [{"url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-611"}]}], "descriptions": [{"lang": "en", "value": "The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0."}, {"lang": "es", "value": "La Consola de Administraci\u00f3n en determinados productos WSO2, permite ataques de tipo XXE durante las actualizaciones de EventReceiver. Esto afecta a la API Manager versiones hasta 3.0.0, la API Manager Analytics versiones 2.2.0 y 2.5.0, la API Microgateway versi\u00f3n 2.2.0, Enterprise Integrator versiones 6.2.0 y 6.3.0 e Identity Server Analytics versiones hasta 5.6.0."}], "lastModified": "2022-04-19T18:28:51.440", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80465515-637E-46D9-9F36-063B8549A539", "versionEndIncluding": "3.0.0"}, {"criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ADEAF56C-4583-40A6-826F-01AC86191AD7"}, {"criteria": "cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "04A2A50A-872E-4CC7-BBB7-3E0956176AAC"}, {"criteria": "cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79CDDE83-4CB6-4DA3-8E96-FCDA4F5C1E93"}, {"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66292C25-B0B9-4FCE-9382-57B8F6BB814A"}, {"criteria": "cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "709DC7EA-18A6-4B83-84CB-F2499BEB5D2F"}, {"criteria": "cpe:2.3:a:wso2:identity_server_analytics:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05810F17-3BC8-400A-92BF-0D51E3580409", "versionEndIncluding": "5.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}