CVE-2025-2905: An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.
This vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks.
On systems running JDK 7 or early JDK 8, full file contents may be exposed.
On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.
DoS attacks such as "Billion Laughs" payloads can cause service disruption.
Other sources
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.
A successful XXE attack could allow a remote, unauthenticated attacker to: Read sensitive files from the server’s filesystem. Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2905?
CVE-2025-2905 is considered a critical vulnerability due to its potential for remote code execution and data exfiltration.
How do I fix CVE-2025-2905?
To fix CVE-2025-2905, ensure you update to the latest version of WSO2 API Manager which includes security patches addressing this vulnerability.
What are the potential impacts of CVE-2025-2905?
The potential impacts of CVE-2025-2905 include unauthorized access to sensitive data, manipulation of application behavior, and exploitation of external entities.
Which versions of WSO2 API Manager are affected by CVE-2025-2905?
CVE-2025-2905 affects all versions of WSO2 API Manager prior to the security patch release.
Can I mitigate CVE-2025-2905 without applying an update?
While it is recommended to apply an update, you may mitigate CVE-2025-2905 by implementing stricter XML input validation and disabling external entity processing.