CVE-2024-2374
XXE Vulnerability in WSO2 XML Parsers Enables Data Exposure and DoS
Publication date: 2026-04-16
Last updated on: 2026-04-23
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | api_manager | From 3.1.0 (inc) to 3.1.0.278 (exc) |
| wso2 | api_manager | From 3.2.0 (inc) to 3.2.0.368 (exc) |
| wso2 | api_manager | From 4.0.0 (inc) to 4.0.0.280 (exc) |
| wso2 | api_manager | From 4.1.0 (inc) to 4.1.0.206 (exc) |
| wso2 | api_manager | From 4.2.0 (inc) to 4.2.0.144 (exc) |
| wso2 | api_manager | From 4.3.0 (inc) to 4.3.0.57 (exc) |
| wso2 | identity_server | From 5.10.0 (inc) to 5.10.0.300 (exc) |
| wso2 | identity_server | From 5.11.0 (inc) to 5.11.0.329 (exc) |
| wso2 | identity_server | From 6.0.0 (inc) to 6.0.0.179 (exc) |
| wso2 | identity_server | From 6.1.0 (inc) to 6.1.0.136 (exc) |
| wso2 | identity_server_as_key_manager | From 5.10.0 (inc) to 5.10.0.296 (exc) |
| wso2 | open_banking_am | From 2.0.0 (inc) to 2.0.0.328 (exc) |
| wso2 | open_banking_iam | From 2.0.0 (inc) to 2.0.0.348 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the XML parsers of multiple WSO2 products, where they accept user-supplied XML data without properly preventing the resolution of external entities.
Because of this, attackers can craft malicious XML payloads that exploit the parser's behavior to include external resources.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can read confidential files from the file system and access limited HTTP resources reachable by the affected product.
Additionally, the vulnerability can be used to perform denial of service attacks by exhausting server resources through recursive entity expansion or by fetching large external resources.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows attackers to read confidential files from the file system and access limited HTTP resources, which could lead to unauthorized disclosure of sensitive data.
Such unauthorized data access and potential data breaches may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.
Additionally, denial of service attacks exploiting this vulnerability could disrupt availability, which is also a consideration under these standards.