CVE-2025-4641: XML External Entity (XXE) injection vulnerability in WebDriverManager
First published: Wed May 14 2025(Updated: )
Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization External Entities Blowup. This vulnerability is associated with program files src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java. This issue affects webdrivermanager: from 1.0.0 before 6.1.0.
Credit: cve_disclosure@tech.gov.sg
| Affected Software | Affected Version | How to fix |
|---|---|---|
| bonigarcia webdrivermanager | >=1.0.0<6.0.2 | |
| maven/io.github.bonigarcia:webdrivermanager | >=1.0.0<6.1.0 | 6.1.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-4641?
CVE-2025-4641 has a medium severity level, indicating a moderate risk of exploitation.
How do I fix CVE-2025-4641?
To fix CVE-2025-4641, update bonigarcia WebDriverManager to a version that is higher than 6.0.2.
What types of systems are affected by CVE-2025-4641?
CVE-2025-4641 affects systems running bonigarcia WebDriverManager on Windows, MacOS, and Linux.
What is the impact of CVE-2025-4641?
The impact of CVE-2025-4641 is related to data serialization and potential exposure to XML external entity attacks.
Can CVE-2025-4641 be exploited remotely?
Yes, CVE-2025-4641 can be exploited remotely if the vulnerable software is exposed to untrusted XML input.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pwm3-776c-8q7q
- alias/CVE-2025-4641
- agent/source
- agent/references
- agent/last-modified-date
- agent/tags
- agent/description
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- vendor/bonigarcia
- canonical/bonigarcia webdrivermanager
- package-manager/maven