WSO2 products process XML data without disallowing external entities, which lets attackers inject malicious XML that causes the parser to request external resources. This flaw permits reading confidential system files and accessing limited remote HTTP resources, and can also lead to denial of service by exhausting server CPU or memory when entities recurse or trigger large external downloads.

The vulnerability affects WSO2 API Manager, WSO2 Identity Server, WSO2 Identity Server as Key Manager, WSO2 Open Banking AM, and WSO2 Open Banking IAM. No specific affected version numbers are listed, so all releases before the vendor’s remediation are potentially vulnerable.

The CVSS score of 7.5 indicates a high impact, with confidentiality and availability risks. EPSS data is not available and the issue is not in CISA’s KEV catalog. An attacker must supply crafted XML to the vulnerable component, which is likely accessible via exposed APIs or configuration endpoints. Once the XML is parsed, the external entity resolution leads to arbitrary file access or resource exhaustion, enabling the DoS attack.