CVE-2025-2905 An XML External Entity (XXE) vulnerability in Multiple WSO2 Products
Remote unauthenticated attackers can read sensitive files or cause denial of service via XML External Entity injection in WSO2 products.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-2905?
CVE-2025-2905 is a critical vulnerability in Wso2 Api Manager, published on 5 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.
A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
Weakness: CWE-611
Which versions are affected by CVE-2025-2905?
2 open source packages ship an affected version, including org.wso2.am:am-distribution-parent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.wso2.am:am-distribution-parent Maven | All versions | 2.1.0 |
org.wso2.am:am-distribution-parent Maven | All versions | 2.1.0 |
Products include Wso2 Api Manager.
How do I fix CVE-2025-2905?
Upgrade org.wso2.am:am-distribution-parent to 2.1.0 or later.
Is CVE-2025-2905 being exploited?
There is no known exploitation of CVE-2025-2905 in the wild and no public exploit code.
Other vulnerabilities in Wso2 Api Manager
- CVE-2022-29464 WSO2 Multiple Products Unrestrictive Upload of File
- CVE-2024-6914 Incorrect Authorization in Multiple WSO2 Products via Account Recovery SOAP Admin Service Leading to Account Takeover
- CVE-2020-13226 WSO2 API Manager vulnerable to SSRF
- CVE-2021-42646 XML external entity in n/a
- CVE-2020-24589 XML external entity in n/a
Sources
Also known as GHSA-h94w-8qhg-3xmc.