CVE-2021-42646

XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests.

• CWE-611

• http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jun/7Mailing List, Third Party Advisory
• https://github.com/wso2/carbon-identity-framework/pull/3472Patch, Third Party Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/
• http://packetstormsecurity.com/files/167465/WSO2-Management-Console-XML-Injection.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jun/7Mailing List, Third Party Advisory
• https://github.com/wso2/carbon-identity-framework/pull/3472Patch, Third Party Advisory
• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2021-1289/

Published

May 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42640PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are …9.1
• CVE-2021-42641PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are …7.5
• CVE-2021-42642PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are …7.5
• CVE-2021-42643cmseasy V7.7.5_20211012 is affected by an arbitrary file wri…8.8
• CVE-2021-42644cmseasy V7.7.5_20211012 is affected by an arbitrary file rea…6.5
• CVE-2021-42645CMSimple_XH 1.7.4 is affected by a remote code execution (RC…10
• CVE-2021-42648Cross-site scripting (XSS) vulnerability exists in Coder Cod…6.1
• CVE-2021-4265A vulnerability was found in siwapp-ror. It has been rated a…6.1
• CVE-2021-42650Cross Site Scripting (XSS vulnerability exists in Portainer …6.1
• CVE-2021-42651A Server Side Template Injection (SSTI) vulnerability in Pen…8.8
• CVE-2021-42654SiteServer CMS < V5.1 is affected by an unrestricted upload …9.8
• CVE-2021-42655SiteServer CMS V6.15.51 is affected by a SQL injection vulne…8.8