WSO2 products vulnerable to XML External Entity attack
Date: 2023-12
Affected: maven/org.wso2.carbon.governance:org.wso2.carbon.governance.common, maven/org.wso2.carbon.analytics-common:org.wso2.carbon.event.input.adapter.core, maven/org.wso2.carbon.event-processing:org.wso2.carbon.event.processor.core
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-6836
CWE: CWE-611
CVSS: 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.


Mitigations:

Architectural layers (MAESTRO):