by Kastro
Paper/Archive/CVE-2025-2905

CVE-2025-2905

WSO2 WSO2 API Manager — An XML External Entity (XXE) vulnerability in Multiple WSO2 Products

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 70.3.703 × 2014.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.

Affected

ProductAffectedFixed inSource
WSO2 API Manager< 2.0.02.0.0CNA
WSO2 API Manager2.1.0–CNA
WSO2 API Manager2.2.0–CNA
WSO2 API Manager2.5.0–CNA
WSO2 API Manager2.6.0–CNA
WSO2 API Manager3.0.0–CNA
WSO2 API Manager3.1.0–CNA
WSO2 API Manager4.0.0 – < 4.0.0.3114.0.0.311CNA
WSO2 API Manager4.1.0 – < 4.1.0.1524.1.0.152CNA
WSO2 API Manager4.2.0 – < 4.2.0.1224.2.0.122CNA
WSO2 Enterprise Integrator6.0.0–CNA
WSO2 Enterprise Integrator6.1.0–CNA

Scores by source

WSO2 (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorysecurity.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993