dbcve.org
Api ManagerApplication · Wso2

CVE-2024-2374

CRITICAL · 9.1 CVSS v3.1 Published 2026-04-16
Fix available
A fix is available. Upgrade to 2.0.0.328 / 2.0.0.348 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of external resources. By leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploited to perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

This is an XML External Entity (XXE) injection vulnerability in multiple WSO2 products. The XML parsers fail to disable external entity resolution, allowing attackers to craft malicious XML payloads that can read confidential files from the server, access internal HTTP resources, or cause denial of service through recursive entity expansion.

MitigationDisable external entity resolution in all XML parsers used by affected WSO2 products by configuring the parser to reject DTDs and external entities, or by using a secure XML parser implementation that has XXE protection enabled by default.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Api ManagerApplication
Affected:>= 3.1.0, < 3.1.0.278>= 3.2.0, < 3.2.0.368>= 4.0.0, < 4.0.0.280>= 4.1.0, < 4.1.0.206>= 4.2.0, < 4.2.0.144>= 4.3.0, < 4.3.0.57
Identity ServerApplication
Affected:>= 5.10.0, < 5.10.0.300>= 5.11.0, < 5.11.0.329>= 6.0.0, < 6.0.0.179>= 6.1.0, < 6.1.0.136
Identity Server As Key ManagerApplication
Affected:>= 5.10.0, < 5.10.0.296
Open Banking AmApplication
Affected:>= 2.0.0, < 2.0.0.328
Open Banking IamApplication
Affected:>= 2.0.0, < 2.0.0.348

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the WSO2 product and version
    Locate the version file or product info. In WSO2 products, the version is typically stored in a text file in the product root directory (commonly 'carbon.xml', 'product-info.xml', or a 'VERSION' file). Check the product's documentation for the exact location if uncertain.
    Affected if The installed version falls within any of the affected ranges listed in the CVE for that specific product.
  2. Verify XML processing is enabled
    Determine if the affected WSO2 product is configured to parse XML content. This includes API import functionality, SOAP API handling, XSLT transformations, or any feature that accepts XML input. Review product configurations for XML-enabled features.
    Affected if The product processes XML content from external sources without restricting external entity resolution.
  3. Check XML parser configuration
    Inspect the XML parser configuration files within the WSO2 product. Look for parser settings in configuration files (commonly in the 'conf' or 'repository/conf' directory). Verify whether the XML parsers are configured to disable external entities and DTD processing.
    Affected if The XML parser configuration does not explicitly disable external entity resolution (the parser allows XXE attacks).
  4. Review deployed APIs and services
    Examine deployed APIs and services that accept XML-based requests. Focus on SOAP APIs, API import features using WSDL or WADL files, and any integration flows that involve XML transformation.
    Affected if There are active APIs or services that process XML payloads from untrusted sources without XXE protection.
  5. Audit parser library settings
    Check the underlying XML parser library configuration. In WSO2 products, this may involve reviewing the jvm startup options or parser-specific configuration files. Verify whether the parser instances are created with security features enabled.
    Affected if The XML parser instances used by the application have external entity resolution enabled by default.

A user is affected if they are running any WSO2 product listed in the CVE within the specified version ranges AND that product processes XML content from external sources.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2.0.0.328 / 2.0.0.348 / 3.1.0.278 or later
Fixed in 2.0.0.3282.0.0.3483.1.0.278
Interim mitigation

Disable external entity resolution in all XML parsers used by affected WSO2 products by configuring the parser to reject DTDs and external entities, or by using a secure XML parser implementation that has XXE protection enabled by default.

Recommended fix High confidence

Upgrade to the minimum fixed version for each product line (e.g., Api Manager 3.1.0.278, Identity Server 5.10.0.300, etc.)

  1. 1. Identify the exact WSO2 product and version currently deployed from the affected versions list
  2. 2. For Api Manager: upgrade to 3.1.0.278 (if currently on 3.1.x), 3.2.0.368 (if on 3.2.x), 4.0.0.280 (if on 4.0.x), or 4.1.0.206 (if on 4.1.x)
  3. 3. For Identity Server: upgrade to 5.10.0.300 (if on 5.10.x), 5.11.0.329 (if on 5.11.x), 6.0.0.179 (if on 6.0.x), or 6.1.0.136 (if on 6.1.x)
  4. 4. For Identity Server As Key Manager: upgrade to 5.10.0.296
  5. 5. For Open Banking Am: upgrade to 2.0.0.328
  6. 6. For Open Banking Iam: upgrade to 2.0.0.348
  7. 7. Test the upgrade in a non-production environment before deploying to production
  8. 8. Deploy the upgraded version to production environment
Caveat Review WSO2 release notes for the target version for any potential compatibility or migration considerations

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Api Manager Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2024-2374 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2024-2374 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data