CVE-2024-2374
Received Received - Intake
XXE Vulnerability in WSO2 XML Parsers Enables Data Exposure and DoS

Publication date: 2026-04-16

Last updated on: 2026-04-23

Assigner: WSO2 LLC

Description
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources. By leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploited to perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-16
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2026-04-16
EPSS Evaluated
2026-06-14
NVD
CVE-2024-2374
EUVD
EUVD-2024-27327
Affected Vendors & Products
Showing 13 associated CPEs
Vendor Product Version / Range
wso2 api_manager From 3.1.0 (inc) to 3.1.0.278 (exc)
wso2 api_manager From 3.2.0 (inc) to 3.2.0.368 (exc)
wso2 api_manager From 4.0.0 (inc) to 4.0.0.280 (exc)
wso2 api_manager From 4.1.0 (inc) to 4.1.0.206 (exc)
wso2 api_manager From 4.2.0 (inc) to 4.2.0.144 (exc)
wso2 api_manager From 4.3.0 (inc) to 4.3.0.57 (exc)
wso2 identity_server From 5.10.0 (inc) to 5.10.0.300 (exc)
wso2 identity_server From 5.11.0 (inc) to 5.11.0.329 (exc)
wso2 identity_server From 6.0.0 (inc) to 6.0.0.179 (exc)
wso2 identity_server From 6.1.0 (inc) to 6.1.0.136 (exc)
wso2 identity_server_as_key_manager From 5.10.0 (inc) to 5.10.0.296 (exc)
wso2 open_banking_am From 2.0.0 (inc) to 2.0.0.328 (exc)
wso2 open_banking_iam From 2.0.0 (inc) to 2.0.0.348 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

This vulnerability allows attackers to read confidential files from the file system and access limited HTTP resources, which could lead to unauthorized disclosure of sensitive data.

Such unauthorized data access and potential data breaches may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access.

Additionally, denial of service attacks exploiting this vulnerability could disrupt availability, which is also a consideration under these standards.

Executive Summary

This vulnerability exists in the XML parsers of multiple WSO2 products, where they accept user-supplied XML data without properly preventing the resolution of external entities.

Because of this, attackers can craft malicious XML payloads that exploit the parser's behavior to include external resources.

Impact Analysis

An attacker exploiting this vulnerability can read confidential files from the file system and access limited HTTP resources reachable by the affected product.

Additionally, the vulnerability can be used to perform denial of service attacks by exhausting server resources through recursive entity expansion or by fetching large external resources.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-2374. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart