Vulnerability · Published May 5, 2025 · Assigned by WSO2
CVE-2025-2905An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
Critical 9.1
In plain English
A critical-severity XML external entity in WSO2 API Manager from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.wso2.am:am-distribution-parent | 2.1.0 | GHSA-h94w-8qhg-3xmc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 0 – before 2.0.02.1.02.2.02.5.02.6.03.0.03.1.04.0.0 – before 4.0.0.311 |
| WSO2 | WSO2 Enterprise Integrator | 6.0.06.1.06.1.16.2.06.3.06.4.06.5.0 |
| WSO2 | WSO2 Enterprise Service Bus | 4.9.05.0.0 |
| WSO2 | WSO2 Micro integrator | 1.0.01.1.01.2.0 – before 1.2.0.1624.0.0 – before 4.0.0.1324.1.0 – before 4.1.0.1154.2.0 – before 4.2.0.112 |
| WSO2 | WSO2 Open Banking AM | 1.5.0 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H