Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WSO2 API Manager
Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
3.0.0.0
Unavailable
None listed
3.0.0.0
affected
custom
3.0.0.1
Unavailable
None listed
WSO2 API Manager Analytics
Vendor
WSO2
Product
WSO2 API Manager Analytics
Platforms
Unknown
Default status
unaffected
WSO2 API Manager Analytics · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
2.2.0.0
Unavailable
None listed
2.2.0.0
affected
custom
2.2.0.1
Unavailable
None listed
2.5.0.0
affected
custom
2.5.0.1
Unavailable
None listed
WSO2 API Microgateway
Vendor
WSO2
Product
WSO2 API Microgateway
Platforms
Unknown
Default status
unaffected
WSO2 API Microgateway · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
2.2.0.0
Unavailable
None listed
2.2.0.0
affected
custom
2.2.0.1
Unavailable
None listed
WSO2 Enterprise Integrator
Vendor
WSO2
Product
WSO2 Enterprise Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Integrator · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
6.0.0.2
Unavailable
None listed
6.0.0.0
affected
custom
6.0.0.3
Unavailable
None listed
6.1.0.0
affected
custom
6.1.0.5
Unavailable
None listed
6.1.1.0
affected
custom
6.1.1.5
Unavailable
None listed
6.6.0.0
affected
custom
6.6.0.1
Unavailable
None listed
WSO2 IS as Key Manager
Vendor
WSO2
Product
WSO2 IS as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 IS as Key Manager · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
5.5.0.0
Unavailable
None listed
5.5.0.0
affected
custom
5.5.0.1
Unavailable
None listed
5.6.0.0
affected
custom
5.6.0.1
Unavailable
None listed
5.7.0.0
affected
custom
5.7.0.1
Unavailable
None listed
5.9.0.0
affected
custom
5.9.0.1
Unavailable
None listed
WSO2 Identity Server
Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
unknown
custom
5.4.0.0
Unavailable
None listed
5.4.0.0
affected
custom
5.4.0.1
Unavailable
None listed
5.4.1.0
affected
custom
5.4.1.1
Unavailable
None listed
5.5.0.0
affected
custom
5.5.0.1
Unavailable
None listed
5.6.0.0
affected
custom
5.6.0.1
Unavailable
None listed
WSO2 Micro Integrator
Vendor
WSO2
Product
WSO2 Micro Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Micro Integrator · Scoped product and version facts