CVE-2020-12719: WSO2 API Manager

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.

Affected products

• WSO2 API Manager: up to and including 3.0.0
• WSO2 API Manager Analytics: up to and including 2.5.0
• WSO2 API Microgateway: version 2.2.0 only
• WSO2 Enterprise Integrator: up to and including 6.4.0
• WSO2 Identity Server: up to and including 5.9.0
• WSO2 Identity Server Analytics: up to and including 5.6.0
• WSO2 Identity Server As Key Manager: up to and including 5.9.0

Published 2020-05-08. Last modified 2026-06-17.