VulnerabilityAnalyzed

CVE-2024-2374

This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources.

CRITICAL 9.1EPSS 0.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources. By leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploited to perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS: 0.38% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-611
Affected: wso2/api manager · wso2/identity server · wso2/identity server as key manager · wso2/open banking am · wso2/open banking iam
Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3255/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.