CVE-2025-2905 — An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple …
Published: 2025-05-05 · CVSS: 9.1 · CVSS 3.1
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products. A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7