{"affected":[{"conditional":false,"product":"api_manager","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"3.1.0","lessThan":"3.1.0.278","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"api_manager","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"3.2.0","lessThan":"3.2.0.368","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"api_manager","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"4.0.0","lessThan":"4.0.0.280","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"api_manager","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"4.1.0","lessThan":"4.1.0.206","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"api_manager","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"4.2.0","lessThan":"4.2.0.144","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"api_manager","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"4.3.0","lessThan":"4.3.0.57","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"identity_server","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"5.10.0","lessThan":"5.10.0.300","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"identity_server","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"5.11.0","lessThan":"5.11.0.329","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"identity_server","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"6.0.0","lessThan":"6.0.0.179","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"identity_server","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"6.1.0","lessThan":"6.1.0.136","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"identity_server_as_key_manager","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"5.10.0","lessThan":"5.10.0.296","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"open_banking_am","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"2.0.0","lessThan":"2.0.0.328","status":"affected","version":"*","versionType":"custom"}]},{"conditional":false,"product":"open_banking_iam","source":"NVD","vendor":"wso2","versions":[{"greaterThanOrEqual":"2.0.0","lessThan":"2.0.0.348","status":"affected","version":"*","versionType":"custom"}]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.1.0.278","versionStartIncluding":"3.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0.368","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.280","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.206","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.144","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.57","versionStartIncluding":"4.3.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.300","versionStartIncluding":"5.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.0.329","versionStartIncluding":"5.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0.179","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.0.136","versionStartIncluding":"6.1.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.296","versionStartIncluding":"5.10.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:open_banking_am:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.328","versionStartIncluding":"2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:open_banking_iam:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.348","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2024-2374","cwes":["CWE-611"],"description":"The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources.\n\nBy leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploited to perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.1,"severity":"critical","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: ed10eef1-636d-4fbe-9993-6890dfa878f8","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1794168600187,"publishedAt":1776330994967,"references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":["Vendor Advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3255/"}],"remediation":[],"revision":"939f69dec71fff95fd0140f47f8dc545aa05d994c178e66d38caacec2823c359","sources":[{"modifiedAt":1794168600187,"name":"NVD","retrievedAt":1794183357464,"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2374"}],"ssvc":{"assessedAt":1776342550744,"automatable":"yes","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"partial"},"status":"published","title":"CVE-2024-2374","updatedAt":1794183357464}