Vulnerability Intelligence Report
An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
CVE-2025-2905
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
No Active Exploit Signals
CVSS Base Score
9.1
CRITICAL
Exploitability:3.9
Impact Score:5.2
EPSS Probability:1.15%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-611 ↗CWE-611 Improper Restriction of XML External Entity Reference
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | 0 < 2.0.0 (affected), 2.1.0 (affected), 2.2.0 (affected), 2.5.0 (affected), 2.6.0 (affected), 3.0.0 (affected), 3.1.0 (affected), 4.0.0 < 4.0.0.311 (affected), 4.1.0 < 4.1.0.152 (affected), 4.2.0 < 4.2.0.122 (affected) |
| WSO2 | WSO2 Enterprise Integrator | 0 < 6.0.0 (unknown), 6.0.0 (affected), 6.1.0 (affected), 6.1.1 (affected), 6.2.0 (affected), 6.3.0 (affected), 6.4.0 (affected), 6.5.0 (affected), 6.6.0 (affected) |
| WSO2 | WSO2 Enterprise Service Bus | 0 < 4.9.0 (unknown), 4.9.0 (affected), 5.0.0 (affected) |
| WSO2 | WSO2 Micro integrator | 0 < 1.0.0 (unknown), 1.0.0 (affected), 1.1.0 (affected), 1.2.0 < 1.2.0.162 (affected), 4.0.0 < 4.0.0.132 (affected), 4.1.0 < 4.1.0.115 (affected), 4.2.0 < 4.2.0.112 (affected) |
| WSO2 | WSO2 Open Banking AM | 0 < 1.5.0 (unknown), 1.5.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
1.146%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | WSO2 LLC · Vendor · USA |
| Reserved | 2025-03-28T08:46:09 |
| Published | 2025-05-05T09:02:01 |
| Last Updated | 2025-10-16T11:39:21 |
Community Chatter & Buzz