CVE-2024-8010

XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files

State: Published
Severity: 3.5 Low
Published: Apr 16, 2026
Updated: Apr 16, 2026
Reserved: Aug 20, 2024

Description

The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references.

By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.

Scores

CVSS	Score	Vector	Source
3.1	3.5 Low	CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	WSO2

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference ('XXE')

Affected Products

Product	Versions
WSO2 API ManagerWSO2	before 3.2.0Unknown 3.2.0 to before 3.2.0.397Affected 3.2.1 to before 3.2.1.27Affected 4.0.0 to before 4.0.0.310Affected 4.0.0 to before 4.0.0.319Affected 4.1.0 to before 4.1.0.171Affected 4.2.0 to before 4.2.0.127Affected 4.3.0 to before 4.3.0.39Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3581/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.