CVEvulnerability

CVE-2025-2905

9.1 CRITICAL Published 2025-05-05 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-05-05
Last modified
2026-06-17
Assigner
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
9.1 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-611

Description

Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.

Affected configurations

• wso2 api manager (<= 2.0.0)

Related

Weakness · CWE (1)

  • CWE-611 Improper Restriction of XML External Entity Reference weakness

References