WSO2 Products XML External Entity Vulnerability Allowing File Read and Denial-of-Service

A vulnerability allowing XML External Entity (XXE) attacks exists in multiple WSO2 products. This issue arises from the XML parser's improper configuration, which allows user-supplied XML to be parsed without adequate restrictions. As a result, external entities can be resolved, potentially enabling a remote, unauthenticated attacker to read sensitive files from the server's filesystem or conduct denial-of-service (DoS) attacks that disrupt affected services.

Impact

Exploitation of this vulnerability could lead to unauthorized reading of sensitive files from the server's filesystem and denial-of-service (DoS) attacks that make affected services unavailable.