by Kastro CVE-2025-10713
WSO2 WSO2 Enterprise Integrator — XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
Description · from the CVE record
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.
Affected
ProductAffectedFixed inSource
WSO2 Enterprise Integrator6.6.0 – < 6.6.0.2236.6.0.223CNA
WSO2 API Control Plane4.5.0 – < 4.5.0.274.5.0.27CNA
WSO2 Universal Gateway4.5.0 – < 4.5.0.254.5.0.25CNA
WSO2 Traffic Manager4.5.0 – < 4.5.0.254.5.0.25CNA
WSO2 API Manager3.1.0 – < 3.1.0.3443.1.0.344CNA
WSO2 API Manager3.2.0 – < 3.2.0.4453.2.0.445CNA
WSO2 API Manager3.2.1 – < 3.2.1.653.2.1.65CNA
WSO2 API Manager4.0.0 – < 4.0.0.3654.0.0.365CNA
WSO2 API Manager4.1.0 – < 4.1.0.2274.1.0.227CNA
WSO2 API Manager4.2.0 – < 4.2.0.1674.2.0.167CNA
WSO2 API Manager4.3.0 – < 4.3.0.794.3.0.79CNA
WSO2 API Manager4.4.0 – < 4.4.0.434.4.0.43CNA
Scores by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
WSO2 (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total