Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2025-2905

An XML External Entity (XXE) vulnerability in Multiple WSO2 Products

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 2.0.0affected
  • 2.1.0affected
  • 2.2.0affected
  • 2.5.0affected
  • 2.6.0affected
  • 3.0.0affected
  • 3.1.0affected
  • 4.0.0 to < 4.0.0.311affected
  • 4.1.0 to < 4.1.0.152affected
  • 4.2.0 to < 4.2.0.122affected

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.0.0unknown
  • 6.0.0affected
  • 6.1.0affected
  • 6.1.1affected
  • 6.2.0affected
  • 6.3.0affected
  • 6.4.0affected
  • 6.5.0affected
  • 6.6.0affected

WSO2 WSO2 Enterprise Service Bus

Default version status: unaffected

  • 0 to < 4.9.0unknown
  • 4.9.0affected
  • 5.0.0affected

WSO2 WSO2 Micro integrator

Default version status: unaffected

  • 0 to < 1.0.0unknown
  • 1.0.0affected
  • 1.1.0affected
  • 1.2.0 to < 1.2.0.162affected
  • 4.0.0 to < 4.0.0.132affected
  • 4.1.0 to < 4.1.0.115affected
  • 4.2.0 to < 4.2.0.112affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 1.5.0unknown
  • 1.5.0affected

References