CVE-2024-8010

· LOWAnalyzed

← All CVEs

CVSS v3.1

3.5

EPSS

0.27%

Published

Apr 16, 2026

Modified

Apr 23, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted XML payload that exploits the unescaped external entity references. By leveraging this vulnerability, a malicious actor can read confidential files from the product's file system or access limited HTTP resources reachable via HTTP GET requests to the vulnerable product.

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-611

Affected Products (6)

wso2 · api_manager (up to 3.2.0.397)vulnerable

wso2 · api_manager (up to 3.2.1.27)vulnerable

wso2 · api_managervulnerable

wso2 · api_manager (up to 4.1.0.171)vulnerable

wso2 · api_manager (up to 4.2.0.127)vulnerable

wso2 · api_manager (up to 4.3.0.39)vulnerable

References (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3581/

Vendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs