Medium
Security advisory
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-24591
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:16 UTC · Revision 1
Source evidence
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.
osv:CVE-2020-24591
Complete source record
{
"id": "d5d97e51b223d5e31573bcd3f1cb182615045681302f3fbb4c7bb8b1414cbbe9",
"url": "https://osv.dev/vulnerability/CVE-2020-24591",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-24591",
"summary": "The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.",
"evidence": "osv:CVE-2020-24591",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-24591",
"aliases": [
"CVE-2020-24591"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wso2/analytics-apim",
"type": "GIT",
"events": [
{
"introduced": "5473541ec4434aeb0a2a1f583d672e1d1748240a"
},
{
"last_affected": "78105a9da92efdcfceaca4c011a7960ebd3df0e3"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wso2:api_manager_analytics:2.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"last_affected": "2.2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wso2:api_manager_analytics:2.5.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.5.0"
},
{
"last_affected": "2.5.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.2.0",
"2.5.0",
"v2.5.0-rc1",
"v2.5.0",
"v2.5.0.Beta",
"v2.5.0-Alpha",
"v2.2.0-update2",
"v2.2.0-update1",
"v2.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24591.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/wso2/product-apim",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "727d091683c8199c37f2d19ab3198abee6553904"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.0.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.0.0-rc3",
"v3.0.0",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-beta",
"v3.0.0-alpha2",
"v3.0.0-alpha",
"v3.0.0-m35",
"v3.0.0-m34",
"v3.0.0-m33",
"v3.0.0-m32",
"v2.6.0-rc3",
"v2.6.0",
"v2.6.0-rc2",
"v2.6.0-rc1",
"v2.6.0-beta2",
"v2.6.0-beta",
"v2.6.0-alpha2",
"v2.6.0-alpha",
"v2.6.0-m2",
"v2.6.0-m1",
"v2.5.0-rc4",
"v2.5.0",
"v2.5.0-rc3",
"v2.5.0-rc2",
"v2.5.0-rc1",
"v2.5.0-Beta",
"v2.5.0-Alpha",
"v2.2.0-update7",
"v2.2.0-update6",
"v2.2.0-update5",
"v2.2.0-update4",
"v2.2.0-update3",
"v2.2.0-update2",
"v2.2.0-update1",
"v2.2.0",
"v2.1.0-update14",
"v2.1.0-update13",
"v2.1.0-update12",
"v2.1.0-update11",
"v2.1.0-update10",
"v2.1.0-update9",
"v2.1.0-update8",
"v2.1.0-update7",
"v2.1.0-update5",
"v2.1.0-update3",
"v2.1.0-update2",
"v2.1.0-update1",
"v2.1.0-alpha",
"v2.0.0-ALPHA",
"v2.0.0-M4",
"v1.9.0",
"v1.9.0-Beta-3",
"v1.9.0-Beta-2",
"v1.9.0-Beta",
"v1.9.0-Alpha",
"test-tag-1.9.0-Alpha",
"v1.9.0-M2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24591.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/wso2/product-ei",
"type": "GIT",
"events": [
{
"introduced": "0f5695f9db169c6486a66ff1a4814a06fc6d6284"
},
{
"last_affected": "f2207c5e9a6eaf4a76dfadd3c62b8fe742c3a2b6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wso2:enterprise_integrator:6.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.2.0"
},
{
"last_affected": "6.2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wso2:enterprise_integrator:6.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.3.0"
},
{
"last_affected": "6.3.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"6.2.0",
"6.3.0",
"v6.3.0-rc2",
"v6.3.0",
"v6.3.0-rc1",
"v6.3.0-m11",
"v6.3.0-m10",
"v6.3.0-m9",
"v6.3.0-m8",
"v6.3.0-m7",
"v6.3.0-m6",
"v6.3.0-m5",
"v6.3.0-m4",
"v6.3.0-m3",
"v6.3.0-m2",
"v6.3.0-m1",
"v6.2.0-rc2",
"v6.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24591.json"
}
}
],
"modified": "2026-10-24T10:30:37.577578199Z",
"provider": "osv",
"references": [
"https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:wso2:identity_server_analytics:*:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:identity_server_analytics",
"extracted_events": [
{
"range": [
{
"last_affected": "5.6.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:api_microgateway:2.2.0:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:api_microgateway",
"extracted_events": [
{
"range": [
{
"introduced": "2.2.0"
},
{
"last_affected": "2.2.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-24591",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 434254,
"published_at": "2020-08-21T20:15:11.093+00:00"
}