CVE-2024-2374
Published: 16 April 2026
Summary
CVE-2024-2374 is a high-severity Improper Restriction of XML External Entity Reference (CWE-611) vulnerability in Wso2 Api Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-2374 is an XML External Entity (XXE) vulnerability, classified under CWE-611, affecting the XML parsers in multiple WSO2 products. These parsers accept user-supplied XML data without proper configuration to prevent the resolution of external entities. Published on 2026-04-16, the flaw has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with network accessibility, low attack complexity, and no privileges required.
Remote attackers without authentication can exploit this vulnerability by crafting malicious XML payloads submitted to the affected products. Successful exploitation enables reading confidential files from the server's file system, accessing limited HTTP resources reachable by the product, or conducting denial-of-service attacks through recursive entity expansion or fetching large external resources, thereby exhausting server resources.
For mitigation details, refer to the WSO2 security advisory at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3255/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27327
Vulnerability details
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities. This omission allows malicious actors to craft XML payloads that exploit the parser's behavior, leading to the inclusion of…
more
external resources. By leveraging this vulnerability, an attacker can read confidential files from the file system and access limited HTTP resources reachable by the product. Additionally, the vulnerability can be exploited to perform denial of service attacks by exhausting server resources through recursive entity expansion or fetching large external resources.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
XXE in public-facing WSO2 XML parsers directly enables remote unauthenticated exploitation for file disclosure and resource exhaustion (T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied XML inputs to block external entity resolution and prevent exploitation for file reads or DoS.
Ensures XML parsers in WSO2 products are configured securely to disable external entity processing, addressing the root cause of the vulnerability.
Mandates timely flaw remediation through patching or updates as specified in the WSO2 advisory to eliminate the XXE vulnerability.