WSO2 API Manager versions 3.2.0 to 4.3.0 improperly restrict XML external entity references, allowing attackers to submit malicious XML payloads that leverage unresolved external entities. This can result in unauthorized disclosure of sensitive files on the system or access to restricted HTTP resources. The vulnerability is classified under CWE-611 and has a CVSS 3.1 base score of 3.5, indicating low severity with limited impact on confidentiality and no impact on integrity or availability. No known exploits are reported in the wild, and no official remediation level or patch is currently documented.

The vulnerability allows an attacker with at least low privileges and network access to the API Manager's publisher interface to read confidential files and access certain HTTP resources. The impact is limited to confidentiality with no integrity or availability effects. The low CVSS score reflects the limited scope and complexity required for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor WSO2 advisories for updates. Until a patch is available, consider restricting access to the publisher interface and validating or sanitizing XML inputs to mitigate exploitation risk.