CVE-2025-2905

criticalpriority · track · 0EPSS 0.013 · 70 %ileEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.29% (70th) EPSS

CVSS 9.1 · critical

Is it mine?

30 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.

cvss

Technical severity, 0–10. One row per scoring source.

9.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.3–9.1

v3.19.1criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsecondary · ENISA EU

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsecondaryexploitability 3.9 · impact 5.2

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hsecondary · OSV

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-611USCWE-611USCWE-611US

affected products (30)

Products and version ranges known to be affected.

WSO2 WSO2 API Manager≤ 3.1.0enisa_euvdEU
WSO2 WSO2 API Manager≤ 3.0.0enisa_euvdEU
WSO2 WSO2 API Manager≤ 2.1.0enisa_euvdEU
WSO2 WSO2 API Manager≤ 2.5.0enisa_euvdEU
WSO2 WSO2 API Manager≤ 2.6.0enisa_euvdEU
WSO2 WSO2 API Manager≤ 2.2.0enisa_euvdEU
WSO2 WSO2 API Manager0 → 2.0.0enisa_euvdEU
WSO2 WSO2 API Manager4.0.0 → 4.0.0.311enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.152enisa_euvdEU
WSO2 WSO2 API Manager4.2.0 → 4.2.0.122enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.5.0enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.4.0enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.1.1enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.2.0enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.1.0enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.0.0enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.6.0enisa_euvdEU
WSO2 WSO2 Enterprise Integrator≤ 6.3.0enisa_euvdEU
WSO2 WSO2 Enterprise Service Bus≤ 4.9.0enisa_euvdEU
WSO2 WSO2 Enterprise Service Bus≤ 5.0.0enisa_euvdEU

showing 20 of 30

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-h94w-8qhg-3xmcWSO2 API Manager XML External Entity (XXE) vulnerability2025-05-05ghsa · osvUS
An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution. This vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks. * On systems running JDK 7 or early JDK 8, full file contents may be exposed. * On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior. * DoS attacks such as "Billion Laughs" payloads can cause service disruption.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu osv NVD CVE.org MITRE

published 2025-05-05modified 2026-06-17

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan