ورود / ثبت‌نام

جزئیات آسیب‌پذیری

CVE-2026-3415

WSO2 API Control PlaneWSO2 API ManagerWSO2 Carbon API GatewayWSO2 Carbon API Management ImplementationWSO2 Traffic ManagerWSO2 Universal Gateway

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

CVSS 3.1
8.7بالا

شرح رسمی (انگلیسی)

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

امتیازهای CVSS

امتیازنسخهمنبعبردار
8.7بالا 3.1 CVEProject cvelistV5 (CNA) (WSO2) CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H

محصولات آسیب‌پذیر

فروشندهمحصولنسخه‌هامنبع
WSO2 WSO2 API Control Plane 4.5.0 ≤ v < 4.5.0.54 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Control Plane 4.6.0 ≤ v < 4.6.0.17 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager v < 3.2.0 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 3.2.0 ≤ v < 3.2.0.472 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 3.2.1 ≤ v < 3.2.1.91 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.1.0 ≤ v < 4.1.0.254 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.2.0 ≤ v < 4.2.0.194 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.3.0 ≤ v < 4.3.0.105 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.4.0 ≤ v < 4.4.0.68 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.5.0 ≤ v < 4.5.0.53 CVEProject cvelistV5 (CNA)
WSO2 WSO2 API Manager 4.6.0 ≤ v < 4.6.0.16 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 6.7.206 ≤ v < 6.7.206.594 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 6.7.210 ≤ v < 6.7.210.95 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 9.20.74 ≤ v < 9.20.74.398 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 9.28.116 ≤ v < 9.28.116.412 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 9.29.120 ≤ v < 9.29.120.228 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 9.30.67 ≤ v < 9.30.67.158 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 9.31.86 ≤ v < 9.31.86.147 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Gateway 9.32.147 ≤ v < 9.32.147.38 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 6.7.206 ≤ v < 6.7.206.594 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 6.7.210 ≤ v < 6.7.210.95 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 9.20.74 ≤ v < 9.20.74.398 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 9.28.116 ≤ v < 9.28.116.412 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 9.29.120 ≤ v < 9.29.120.228 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 9.30.67 ≤ v < 9.30.67.158 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 9.31.86 ≤ v < 9.31.86.147 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Carbon API Management Implementation 9.32.147 ≤ v < 9.32.147.38 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Traffic Manager 4.5.0 ≤ v < 4.5.0.52 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Traffic Manager 4.6.0 ≤ v < 4.6.0.16 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Universal Gateway 4.5.0 ≤ v < 4.5.0.53 CVEProject cvelistV5 (CNA)
WSO2 WSO2 Universal Gateway 4.6.0 ≤ v < 4.6.0.16 CVEProject cvelistV5 (CNA)

منابع و راهنماها

۱
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.

اطلاعات

تاریخ انتشار
۱۴۰۵/۰۵/۱۵
آخرین به‌روزرسانی
۱۴۰۵/۰۸/۰۶
وضعیت
منتشرشده
صادرکننده (CNA)
WSO2

پیش‌بینی بهره‌برداری (EPSS)

۰٫۴۸٪
احتمال بهره‌برداری در ۳۰ روز
۴۲٪
صدک (نسبت به همه‌ی CVEها)

ارزیابی SSVC (CISA)

قابل خودکارسازی
خیر
وضعیت بهره‌برداری
ندارد
اثر فنی
جزئی

ضعف‌ها (CWE)

  • CWE-776
    Improper Handling of Special Elements in XML Document Type Declaration (DTD)