CVE-2024-8010
Low
Description
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.
SeverityLow
CVSS3.5
Exploit probability—
ProductWso2 Api Manager
PublishedApr 16, 2026
First seenApr 16, 2026
Weakness typeCWE-611XML external entity (XXE)
How to fix
Update
- wso2 api_manager3.2.0.397, 3.2.1.27, 4.1.0.171, 4.2.0.127, 4.3.0.39 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wso2 api_manager | 3.2.0 ≤ v < 3.2.0.397, 3.2.1 ≤ v < 3.2.1.27, 4.0.0 ≤ v ≤ 4.0.0.310, 4.1.0 ≤ v < 4.1.0.171, 4.2.0 ≤ v < 4.2.0.127, 4.3.0 ≤ v < 4.3.0.39 | 3.2.0.397, 3.2.1.27, 4.1.0.171, 4.2.0.127, 4.3.0.39 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.