by Kastro
Paper/Archive/CVE-2025-4641

CVE-2025-4641

bonigarcia webdrivermanager — XML External Entity (XXE) injection vulnerability in WebDriverManager

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 46.5.465 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization External Entities Blowup. This vulnerability is associated with program files src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java. This issue affects webdrivermanager: from 1.0.0 before 6.0.2.

Affected

ProductAffectedFixed inSource
webdrivermanager1.0.0 – < 6.0.26.0.2CNA

Scores by source

GovTech CSG (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/bonigarcia/webdrivermanager/pull/1458