CVEvulnerability

CVE-2025-10713

9.1 CRITICAL Published 2025-11-05 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-11-05
Last modified
2026-06-17
Assigner
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1 ([email protected])
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-611

Description

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.

Affected configurations

• wso2 api control plane 4.5.0 • wso2 api manager 3.1.0 • wso2 api manager 3.2.0 • wso2 api manager 3.2.1 • wso2 api manager 4.0.0 • wso2 api manager 4.1.0 • wso2 api manager 4.2.0 • wso2 api manager 4.3.0 • wso2 api manager 4.4.0 • wso2 api manager 4.5.0 • wso2 enterprise integrator 6.6.0 • wso2 identity server 5.10.0 • wso2 identity server 5.11.0 • wso2 identity server 7.1.0 • wso2 open banking am 2.0.0 • wso2 open banking iam 2.0.0 • wso2 traffic manager 4.5.0 • wso2 universal gateway 4.5.0

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References