Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
多款WSO2产品代码问题漏洞
Vulnerability Description
WSO2 API Manager等都是美国WSO2公司的产品。WSO2 API Manager是一套API生命周期管理解决方案。WSO2 Identity Server（IS）是一款身份认证服务器。WSO2 IS as Key Manager是一款密钥管理器。 WSO2 多款产品存在安全漏洞，该漏洞源于在管理控制台的基于文件的服务提供程序创建功能中发现了一个 XML 外部实体问题。攻击者利用该漏洞可以从文件系统读取机密文件，或通过耗尽服务器资源来执行拒绝服务攻击。以下产品和版本受到影响：WSO2 API
CVSS Information
N/A
Vulnerability Type
N/A