WSO2-2020-0731: XXE and XSS vulnerabilities in WSO2 Carbon

A potential XXE and XSS have been identified in multiple WSO2 Products.

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Why no CVE?

Neither me nor the vendor requested a CVE for these vulnerabilities.

Requirements:

This vulnerability requires:

• Convincing a legitimate WSO2 user to add a malicious repository
  OR
  
• Valid user credentials

Proof Of Concept:

More details and the exploitation process can be found in this PDF.