VulnerabilityPublished 21 May 2019Updated 30 May 2025

CVE-2019-6513: WSO2 API Manager

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 17:16 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 1.3% chance of exploitation in 30 days – higher than 71% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 21 May 2019
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
n/a n/a	Affected =2.6.0	Fixed in–

AI-suggested

To mitigate this vulnerability, organizations should implement strict file upload validation beyond simple extension checks. This includes verifying the MIME type and content of uploaded files to ensure they match expected formats for API documentation (e.g., PDF, HTML, Markdown). Applying server-side scanning for malware on uploaded files is recommended. Restricting upload permissions to only trusted and necessary users can reduce risk. Additionally, organizations should upgrade to a patched version of WSO2 API Manager if available or apply vendor-recommended patches once released. In the absence of patches, consider deploying web application firewalls (WAFs) with rules to detect and block suspicious file uploads. Regular auditing of uploaded files and monitoring for anomalous activity related to file uploads can help detect exploitation attempts. Finally, enforcing the principle of least privilege on user accounts and implementing multi-factor authentication can reduce the risk of credential compromise leading to exploitation.

Description

An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.

Impact

For European organizations using WSO2 API Manager 2.6.0, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of their API management infrastructure. An attacker exploiting this flaw could upload malicious files disguised as documentation, potentially leading to server compromise or lateral movement within the network. This could result in unauthorized access to sensitive API data, disruption of API services, or the deployment of malware within the environment. Given that APIs often serve as critical integration points for business applications, exploitation could impact business continuity and data privacy compliance obligations under regulations such as GDPR. The requirement for authentication limits the attack surface to internal or trusted users, but insider threats or compromised credentials could still enable exploitation. The absence of known exploits suggests the risk is currently theoretical but should not be underestimated given the potential severity of consequences if exploited.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Jul 2025, 14:58 UTC

Technical details

References

Community reviews

Related threats