Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-10713

XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.223affected

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.27affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.25affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.25affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.344affected
  • 3.2.0 to < 3.2.0.445affected
  • 3.2.1 to < 3.2.1.65affected
  • 4.0.0 to < 4.0.0.365affected
  • 4.1.0 to < 4.1.0.227affected
  • 4.2.0 to < 4.2.0.167affected
  • 4.3.0 to < 4.3.0.79affected
  • 4.4.0 to < 4.4.0.43affected
  • 4.5.0 to < 4.5.0.26affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.373affected
  • 5.11.0 to < 5.11.0.417affected
  • 7.1.0 to < 7.1.0.29affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.413affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.393affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.363affected

WSO2 org.wso2.carbon.mediation:org.wso2.carbon.localentry

Default version status: unknown

  • 4.7.30 to < 4.7.30.46affected
  • 4.7.61 to < 4.7.61.61affected
  • 4.7.99 to < 4.7.99.303affected
  • 4.7.131 to < 4.7.131.21affected
  • 4.7.175 to < 4.7.175.29affected
  • 4.7.188 to < 4.7.188.11affected
  • 4.7.204 to < 4.7.204.12affected
  • 4.7.221 to < 4.7.221.6affected
  • 4.7.245 to < 4.7.245.6affected
  • 4.7.259 to ≤ *unaffected

References