VULNERABILITY INTELLIGENCE

CVE-2020-24591

CVSS score6.5 MEDIUM
EPSS probability1.03%
CISA KEVNot currently listed
Published2020-08-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H

Description

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.

Weakness classification

  • CWE-611: Improper Restriction of XML External Entity Reference

Primary references