CVE-2024-8010
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
WSO2 API Manager
- Vendor
- WSO2
- Product
- WSO2 API Manager
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0 | unknown | custom | 3.2.0 | Unavailable | None listed |
| 3.2.0 | affected | custom | 3.2.0.397 | Unavailable | None listed |
| 3.2.1 | affected | custom | 3.2.1.27 | Unavailable | None listed |
| 4.0.0 | affected | custom | 4.0.0.310 | Unavailable | None listed |
| 4.0.0 | affected | custom | 4.0.0.319 | Unavailable | None listed |
| 4.1.0 | affected | custom | 4.1.0.171 | Unavailable | None listed |
| 4.2.0 | affected | custom | 4.2.0.127 | Unavailable | None listed |
| 4.3.0 | affected | custom | 4.3.0.39 | Unavailable | None listed |