CVE-2021-42646

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-42646
XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:P

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2022/Jun/7 Mailing List Third Party Advisory
https://github.com/wso2/carbon-identity-framework/pull/3472 Patch Third Party Advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*
History

11 Jan 2024, 03:15

Type Values Removed Values Added
References
  • {'url': 'https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1289', 'tags': ['Vendor Advisory'], 'source': 'cve@mitre.org'}
  • () https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/ -

29 Nov 2022, 16:48

Type Values Removed Values Added
References (MISC) http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html - (MISC) http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html - Third Party Advisory, VDB Entry
References (FULLDISC) http://seclists.org/fulldisclosure/2022/Jun/7 - (FULLDISC) http://seclists.org/fulldisclosure/2022/Jun/7 - Mailing List, Third Party Advisory

19 Jun 2022, 19:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.html -

11 Jun 2022, 08:15

Type Values Removed Values Added
References
  • (FULLDISC) http://seclists.org/fulldisclosure/2022/Jun/7 -

20 May 2022, 15:48

Type Values Removed Values Added
CPE cpe:2.3:a:wso2:identity_server:5.8.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.9.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.9.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:2.6.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.7.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server_as_key_manager:5.7.0:*:*:*:*:*:*:*
First Time Wso2
Wso2 api Manager
Wso2 identity Server As Key Manager
Wso2 identity Server
CVSS v2 : unknown
v3 : unknown 		v2 : 6.4
v3 : 9.1
References (MISC) https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1289 - (MISC) https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1289 - Vendor Advisory
References (MISC) https://github.com/wso2/carbon-identity-framework/pull/3472 - (MISC) https://github.com/wso2/carbon-identity-framework/pull/3472 - Patch, Third Party Advisory
CWE CWE-611

11 May 2022, 18:33

Type Values Removed Values Added
New CVE
Information

Published : 2022-05-11 18:15

Updated : 2024-01-11 03:15

NVD link : CVE-2021-42646

Mitre link : CVE-2021-42646

CVE.ORG link : CVE-2021-42646

JSON object : View

Products Affected

wso2

  • api_manager
  • identity_server_as_key_manager
  • identity_server
CWE
CWE-611

Improper Restriction of XML External Entity Reference