CVE-2021-42646
mediumpriority · track · 37EPSS 0.038 · 90 %ileEUUSEPSS · scored 2026-10-27
XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–critical · 6.4–9.1
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (14)
Products and version ranges known to be affected.
- wso2 identity server as key manager= 5.10.0nvdUScpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*
- wso2 identity server as key manager= 5.7.0nvdUScpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*
- wso2 identity server as key manager= 5.9.0nvdUScpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (14)
External citations — patches, advisories, analysis.
- http://seclists.org/fulldisclosure/2022/Jun/7cnnvd
- https://cxsecurity.com/cveshow/CVE-2021-42646/cnnvd
- https://cxsecurity.com/issue/WLB-2022060059cnnvd
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1289cnnvd
- https://github.com/wso2/carbon-identity-framework/pull/3472cnnvd
- https://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.htmlcnnvd
- http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.htmlenisa_euvd
- http://seclists.org/fulldisclosure/2022/Jun/7enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan