CVE-2025-2905

Published May 5, 2025

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-2905 is an XML External Entity (XXE) vulnerability found in WSO2 API Manager 2.0.0 and earlier. The vulnerability exists in the gateway component due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution. An unauthenticated remote attacker can exploit this vulnerability to read files from the server's filesystem or perform denial-of-service (DoS) attacks. The extent of file access depends on the Java runtime environment; full file contents may be exposed on JDK 7 or early JDK 8, while later versions of JDK 8 and newer may only expose the first line of a file. A patch has been released under WSO2-2016-0151, which also resolves a previously disclosed XSS vulnerability.

Description: Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
NVD status: Modified
Products: api_manager

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Severity: CRITICAL

Weaknesses

ed10eef1-636d-4fbe-9993-6890dfa878f8: CWE-611

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D867B74E-5FA8-46AF-86D2-FFD478CD5ACC",
            "versionEndIncluding": "2.0.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.