CVE-2020-12719: 
WSO2 API Manager vulnerability analysis and mitigation

An XML External Entity (XXE) vulnerability was discovered in the Management Console of multiple WSO2 products, identified as CVE-2020-12719. The vulnerability affects WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier. The vulnerability was disclosed on May 8, 2020 (AttackerKB).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.2 (High), with an Impact Score of 5.9 and Exploitability Score of 1.2. The attack vector is Network-based with Low attack complexity, requiring High privileges and No user interaction. The vulnerability affects Confidentiality, Integrity, and Availability, all rated as High impact. The vulnerability is classified under CWE-611 (AttackerKB).

The vulnerability can potentially lead to high impacts on system Confidentiality, Integrity, and Availability. As an XXE vulnerability, it could allow attackers to read sensitive files, cause denial of service, or execute server-side request forgery attacks when successfully exploited (AttackerKB).

The vulnerability requires high privileges to exploit, suggesting a more limited attack surface. The attack vector is network-based with low attack complexity, though the requirement for authentication provides some inherent protection (AttackerKB).