CVE-2020-24591

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-21 · updated 2026-06-17
Weakness: CWE-611

Description

The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.

Affected products

WSO2 API Manager: through 3.0.0
WSO2 API Manager Analytics: 2.2.0, 2.5.0
WSO2 Api Microgateway: 2.2.0
WSO2 Enterprise Integrator: 6.2.0, 6.3.0
WSO2 Identity Server Analytics: through 5.6.0

References

https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728

Get alerted when CVE-2020-24591 or the next vulnerability affects your stack