PT-2026-33283 · Wso2 · Wso2 Products

Published 2026-04-16 · Updated 2026-04-16 · CVE-2024-2374

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description XML parsers in several products fail to properly configure the handling of user-supplied XML data to prevent the resolution of external entities. This allows attackers to use crafted XML payloads to include external resources, enabling the reading of confidential files from the file system and access to limited reachable HTTP resources. This issue can also be used to cause a denial of service by fetching large external resources or through recursive entity expansion, which exhausts server resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-2374

Affected Products

Wso2 Products

References · 3

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3255 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2374 · Security Note
• https://twitter.com/VulmonFeeds/status/2044722905007673747 · Twitter Post