What’s Vulnerable › Vulnerabilities
CVE-2024-8010: XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-16 · updated 2026-06-17
- Weakness: CWE-611
Description
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.
Affected products
- WSO2 API Manager: from 3.2.0 before 3.2.0.397; from 3.2.1 before 3.2.1.27; from 4.0.0 through 4.0.0.310; from 4.1.0 before 4.1.0.171; from 4.2.0 before 4.2.0.127; from 4.3.0 before 4.3.0.39 — fixed in 3.2.0.397, 3.2.1.27, 4.1.0.171, 4.2.0.127, 4.3.0.39
How to fix
Upgrade to a fixed version: WSO2 API Manager 3.2.0.397, 3.2.1.27, 4.1.0.171, 4.2.0.127. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-8010 or the next vulnerability affects your stack