In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13883
Reference (s):
- https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0727