{"id":"CVE-2025-2905","aliases":["EUVD-2025-13367","GHSA-h94w-8qhg-3xmc"],"status":"published","title":"An XML External Entity (XXE) vulnerability in Multiple WSO2 Products","description":"Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.\n\nA successful XXE attack could allow a remote, unauthenticated attacker to:\n  *  Read sensitive files from the server’s filesystem.\n  *  Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01317,"percentile":0.71162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2025-05-05T09:02:01Z","modified":"2026-10-24T10:30:31Z","fixes":[{"ecosystem":"Maven","package":"org.wso2.am:am-distribution-parent","fixed_in":["2.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.wso2.am:am-distribution-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.wso2.am:am-distribution-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}],"versions":["1.10.0","2.0.0","2.1.0-alpha"]}],"products":[{"vendor":"wso2","product":"api_manager"},{"vendor":"wso2","product":"wso2 api manager"},{"vendor":"wso2","product":"wso2 enterprise integrator"},{"vendor":"wso2","product":"wso2 enterprise service bus"},{"vendor":"wso2","product":"wso2 micro integrator"},{"vendor":"wso2","product":"wso2 open banking am"}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993/","tags":["vendor-advisory","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2905","tags":["advisory"]},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h94w-8qhg-3xmc"},{"url":"https://github.com/wso2/product-apim","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-2905","title":"An XML External Entity (XXE) vulnerability in Multiple WSO2 Products","description":"Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.\n\nA successful XXE attack could allow a remote, unauthenticated attacker to:\n  *  Read sensitive files from the server’s filesystem.\n  *  Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.","status":"published","published":"2025-05-05T09:02:01.489Z","modified":"2025-10-16T11:39:21.741Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-13367","description":"Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.\n\nA successful XXE attack could allow a remote, unauthenticated attacker to:\n  *  Read sensitive files from the server’s filesystem.\n  *  Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.","status":"published","published":"2025-05-05T09:02:01Z","modified":"2025-10-16T11:39:21Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T20:31:31.065489Z"}],"ghsa":[{"id":"GHSA-h94w-8qhg-3xmc","title":"WSO2 API Manager XML External Entity (XXE) vulnerability","description":"An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.\n\nThis vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks.\n\n  *  On systems running JDK 7 or early JDK 8, full file contents may be exposed.\n\n  *  On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.\n\n  *  DoS attacks such as \"Billion Laughs\" payloads can cause service disruption.","status":"published","published":"2025-05-05T09:31:09Z","modified":"2025-05-05T19:58:09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:38:42.263728Z"}],"nvd":[{"id":"CVE-2025-2905","description":"Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.\n\nA successful XXE attack could allow a remote, unauthenticated attacker to:\n  *  Read sensitive files from the server’s filesystem.\n  *  Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.","status":"published","published":"2025-05-05T09:15:15.923Z","modified":"2026-06-17T09:07:49.44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:11:04.33372Z"}],"osv":[{"id":"CVE-2025-2905","description":"Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.\n\nA successful XXE attack could allow a remote, unauthenticated attacker to:\n  *  Read sensitive files from the server’s filesystem.\n  *  Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.","status":"published","published":"2025-05-05T09:15:15.923Z","modified":"2026-10-24T10:30:31.026222316Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"GHSA-h94w-8qhg-3xmc","title":"WSO2 API Manager XML External Entity (XXE) vulnerability","description":"An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.\n\nThis vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks.\n\n  *  On systems running JDK 7 or early JDK 8, full file contents may be exposed.\n\n  *  On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.\n\n  *  DoS attacks such as \"Billion Laughs\" payloads can cause service disruption.","status":"published","published":"2025-05-05T09:31:09Z","modified":"2025-05-05T20:42:09.307666Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}