WSO2 Vulnerabilities and Affected Products
Vulnerabilities associated with api_manager.
Products
Clear product- WSO2 API Manager64 vulnerabilities
- WSO2 Identity Server59 vulnerabilities
- WSO2 Identity Server as Key Manager36 vulnerabilities
- WSO2 Open Banking IAM34 vulnerabilities
- WSO2 API Control Plane33 vulnerabilities
- WSO2 Open Banking AM30 vulnerabilities
- WSO2 Traffic Manager30 vulnerabilities
- WSO2 Universal Gateway29 vulnerabilities
- WSO2 Enterprise Integrator23 vulnerabilities
- WSO2 Open Banking KM8 vulnerabilities
- WSO2 Micro Integrator7 vulnerabilities
- WSO2 Carbon API Management Implementation5 vulnerabilities
- WSO2 Carbon API Manager Rest API Utility4 vulnerabilities
- WSO2 Enterprise Mobility Manager4 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.base3 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.ui3 vulnerabilities
- WSO2 Carbon Identity Application Authentication Framework3 vulnerabilities
- WSO2 Carbon MagicLink Authenticator Module3 vulnerabilities
- WSO2 Enterprise Service Bus3 vulnerabilities
- WSO2 IS as Key Manager3 vulnerabilities
- api_manager2 vulnerabilities
- carbon-registry2 vulnerabilities
- Email OTP Authenticator2 vulnerabilities
- org.wso2.carbon:org.wso2.carbon.server.admin2 vulnerabilities
- WSO2 API Manager Analytics2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2020-17453MEDIUM | WSO2 api_manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. | CVSS6.1v3.1 | EPSS26.1% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2020-24589CRITICAL | WSO2 api_manager Improper Restriction of XML External Entity ReferenceThe Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. | CVSS9.1v3.1 | EPSS26.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |