| Field | 05/12/2022 12:45 PM | 05/14/2022 03:35 PM |
|---|
| vendor | WSO2 | WSO2 |
| name | API Manager/IS as Key Manager/Identity Server | API Manager/IS as Key Manager/Identity Server |
| component | File Based Service Provider Creation | File Based Service Provider Creation |
| cwe | 611 (XML External Entity) | 611 (XML External Entity) |
| risk | 1 | 1 |
| cvss3_vuldb_s | U | U |
| cvss3_vuldb_c | L | L |
| cvss3_vuldb_i | L | L |
| cvss3_vuldb_a | L | L |
| cvss3_vuldb_rl | O | O |
| cvss3_vuldb_rc | C | C |
| url | https://github.com/wso2/carbon-identity-framework/pull/3472 | https://github.com/wso2/carbon-identity-framework/pull/3472 |
| name | Patch | Patch |
| patch_url | https://github.com/wso2/carbon-identity-framework/pull/3472 | https://github.com/wso2/carbon-identity-framework/pull/3472 |
| cve | CVE-2021-42646 | CVE-2021-42646 |
| cve_assigned | 1634508000 | 1634508000 |
| date | 1652306400 (05/12/2022) | 1652306400 (05/12/2022) |
| type | Automation Software | Automation Software |
| cvss2_vuldb_ci | P | P |
| cvss2_vuldb_ii | P | P |
| cvss2_vuldb_ai | P | P |
| cvss2_vuldb_rc | C | C |
| cvss2_vuldb_rl | OF | OF |
| cvss2_vuldb_av | A | A |
| cvss2_vuldb_ac | M | M |
| cvss2_vuldb_au | S | S |
| cvss2_vuldb_e | ND | ND |
| cvss3_vuldb_av | A | A |
| cvss3_vuldb_ac | L | L |
| cvss3_vuldb_pr | L | L |
| cvss3_vuldb_ui | N | N |
| cvss3_vuldb_e | X | X |
| cvss2_vuldb_basescore | 4.9 | 4.9 |
| cvss2_vuldb_tempscore | 4.3 | 4.3 |
| cvss3_vuldb_basescore | 5.5 | 5.5 |
| cvss3_vuldb_tempscore | 5.3 | 5.3 |
| cvss3_meta_basescore | 5.5 | 5.5 |
| cvss3_meta_tempscore | 5.3 | 5.3 |
| price_0day | $0-$5k | $0-$5k |
| cve_nvd_summary | | XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests. |