description: WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AC:H/AV:N/A:L/C:L/I:N/PR:H/S:C/UI:R
version: 3.0
]