CVE-2020-13226

CRITICAL

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS2.1%
Percentile82th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

WSO2 API Manager 3.0.0 is vulnerable to Server-Side Request Forgery (SSRF) due to improper restriction of outbound network access from a Publisher node, potentially allowing an attacker to access the entire intranet.

BSID: BS-2020-GLOBAL-185129-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-13226?
WSO2 API Manager 3.0.0 is vulnerable to Server-Side Request Forgery (SSRF) due to improper restriction of outbound network access from a Publisher node, potentially allowing an attacker to access the entire intranet.
What is the CVSS score for CVE-2020-13226?
CVE-2020-13226 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 2.1%.
Is CVE-2020-13226 actively exploited?
No confirmed active exploitation of CVE-2020-13226 as of 2026-09-25.
How do I remediate CVE-2020-13226?
Priority: IMMEDIATE. Advisory: https://docs.wso2.com/display/Security/Security+Advisories PSIRT: [email protected]
What systems are affected by CVE-2020-13226?
CVE-2020-13226 affects Wso2 Api Manager.
Vulnerability Details
CVE IDCVE-2020-13226
BSIDBS-2020-GLOBAL-185129-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-05-20
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker with access to the Publisher node can exploit this vulnerability to make the server send requests to arbitrary internal network addresses, leading to information disclosure and potential unauthorized actions within the intranet.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Wso2 Api Manager 3.0.0
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2339 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash7f20651bef1550f8a804e0a704279d3032db9ee078fe3b25998ddd2e50e72edb33f75c474255fb45894013384be03b32766baccc7fad05f35cd32a691d8e451d
Related CVEs affecting Wso2
CVE-2026-5430 10.0 The JWT authentication mechanism accepts tokens signed with algorithms other ... CVE-2026-2053 10.0 The WSO2 API Manager's message flow component, when processing WS-Addressing ... CVE-2025-9152 9.8 An improper privilege management vulnerability exists in WSO2 API Manager due... CVE-2024-6914 9.8 An incorrect authorization vulnerability exists in multiple WSO2 products due... CVE-2022-29464 9.8 Certain WSO2 products allow unrestricted file upload with resultant remote co...
View all Wso2 CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →