Riskcovery

CVE-2025-10713

XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration

State
Published
Severity
6.5 Medium
Published
Nov 5, 2025
Updated
Nov 5, 2025
Reserved
Sep 19, 2025

Read the record on cve.org

Description

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities.

A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:HWSO2

Weaknesses

  • CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

ProductVersions
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.223Affected
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.27Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.25Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.25Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.344Affected
  • 3.2.0 to before 3.2.0.445Affected
  • 3.2.1 to before 3.2.1.65Affected
  • 4.0.0 to before 4.0.0.365Affected
  • 4.1.0 to before 4.1.0.227Affected
  • 4.2.0 to before 4.2.0.167Affected
  • 4.3.0 to before 4.3.0.79Affected
  • 4.4.0 to before 4.4.0.43Affected
  • 4.5.0 to before 4.5.0.26Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.373Affected
  • 5.11.0 to before 5.11.0.417Affected
  • 7.1.0 to before 7.1.0.29Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.413Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.393Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.363Affected
org.wso2.carbon.mediation:org.wso2.carbon.localentryWSO2
  • 4.7.30 to before 4.7.30.46Affected
  • 4.7.61 to before 4.7.61.61Affected
  • 4.7.99 to before 4.7.99.303Affected
  • 4.7.131 to before 4.7.131.21Affected
  • 4.7.175 to before 4.7.175.29Affected
  • 4.7.188 to before 4.7.188.11Affected
  • 4.7.204 to before 4.7.204.12Affected
  • 4.7.221 to before 4.7.221.6Affected
  • 4.7.245 to before 4.7.245.6Affected
  • 4.7.259 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.