CVE-2024-2374 is a high severity (7.5) XML external entity flaw in several WSO2 products, including API Manager and Identity Server. Their XML parsers accept external entities. WSO2 lists fixed update levels for subscribers and says community users should move to the latest unaffected version.
What's affected
WSO2 advisory WSO2-2024-3255 lists these affected versions:
- API Manager: 4.3.0, 4.2.0, 4.1.0, 4.0.0, 3.2.0 and 3.1.0
- Identity Server: 6.1.0, 6.0.0, 5.11.0 and 5.10.0
- Identity Server as Key Manager: 5.10.0
- Open Banking AM 2.0.0 and Open Banking IAM 2.0.0
Subscribers should apply at least these update levels: API Manager 4.3.0 level 57, 4.2.0 level 144, 4.1.0 level 206, 4.0.0 level 280, 3.2.0 level 368, 3.1.0 level 278. Identity Server 6.1.0 level 136, 6.0.0 level 179, 5.11.0 level 329, 5.10.0 level 300. Identity Server as Key Manager 5.10.0 level 296. Open Banking AM 2.0.0 level 328 and Open Banking IAM 2.0.0 level 348.
Community users of the open source products should migrate to the latest unaffected release. The advisory lists no interim workaround.
How to check if you're exposed
Find the product version and your current update level.
- On a WSO2 server, the version is in the product directory name and in the startup log.
- Subscribers can run the WSO2 Updates tool for the product, which shows the current update level, then compare it with the table above.
- Community users should compare the installed release with the latest release listed on the WSO2 site.
The record describes three outcomes: reading confidential files from the server, reaching limited HTTP resources from the product, and denial of service through recursive entity expansion or large external fetches.
What to do now
- List every WSO2 API Manager, Identity Server and Open Banking deployment, including test and disaster recovery copies.
- Subscribers: run WSO2 Updates and reach at least the level in the table for your version.
- Community users: plan the move to the latest unaffected release.
- Restrict outbound network access from the servers, so a parser that fetches an external resource cannot reach internal services or the internet freely.
- Rotate secrets stored on the file system of exposed servers if you cannot rule out file reads.
Why it matters
The weakness is CWE-611, improper restriction of XML external entity reference. An XML document can declare an entity that points to a file or a URL. If the parser is configured to resolve those, it fetches the target and puts the content into the document. The fix is to configure the parser so that it does not resolve external entities or document type declarations.
Identity and API gateway products sit at a central point of trust. They hold keys, certificates and configuration on disk. A file read in such a product can expose more than a read in an ordinary application, and the record also notes that parsing can be used to exhaust server resources.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The advisory lists none. The remedy is the update level or a newer release.
Which class of flaw is this?
XML external entity processing, tracked as CWE-611.
Sources
Last reviewed: 19 October 2026.
