CVE-2020-24591: 
WSO2 API Manager vulnerability analysis and mitigation

The Management Console in certain WSO2 products was found to be vulnerable to XML External Entity (XXE) attacks during EventReceiver updates (CVE-2020-24591). This vulnerability affects multiple WSO2 products including API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0. The vulnerability was disclosed on August 21, 2020 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H. The vulnerability is classified under CWE-611 (Improper Restriction of XML External Entity Reference). The attack vector is network-based, requires high privileges, but no user interaction, and can potentially lead to high impacts on confidentiality and availability (NVD, AttackerKB).

If successfully exploited, this XXE vulnerability could allow attackers to gain read access to sensitive information or cause a denial of service via crafted requests. The vulnerability affects the confidentiality and availability of the system, though integrity remains unaffected (NVD).

The vulnerability requires high privileges to exploit and network access to the target system. While the attack complexity is considered low, the requirement for high-level privileges makes this vulnerability less likely to be exploited by casual attackers (AttackerKB).

Organizations using affected versions of WSO2 products should upgrade to the latest versions that contain fixes for this vulnerability. The specific versions affected include API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0 (NVD).