Description
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities.
A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.
Metrics
CVSS 3.1 9.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Enterprise Integrator | >= 6.6.0, < 6.6.0.223 |
| WSO2 | WSO2 API Control Plane | >= 4.5.0, < 4.5.0.27 |
| WSO2 | WSO2 Universal Gateway | >= 4.5.0, < 4.5.0.25 |
| WSO2 | WSO2 Traffic Manager | >= 4.5.0, < 4.5.0.25 |
| WSO2 | WSO2 API Manager | >= 3.1.0, < 3.1.0.344; >= 3.2.0, < 3.2.0.445; >= 3.2.1, < 3.2.1.65; >= 4.0.0, < 4.0.0.365; >= 4.1.0, < 4.1.0.227; >= 4.2.0, < 4.2.0.167; >= 4.3.0, < 4.3.0.79; >= 4.4.0, < 4.4.0.43; >= 4.5.0, < 4.5.0.26 |
| WSO2 | WSO2 Identity Server | >= 5.10.0, < 5.10.0.373; >= 5.11.0, < 5.11.0.417; >= 7.1.0, < 7.1.0.29 |
| WSO2 | WSO2 Open Banking IAM | >= 2.0.0, < 2.0.0.413 |
| WSO2 | WSO2 Open Banking AM | >= 2.0.0, < 2.0.0.393 |
| WSO2 | WSO2 Identity Server as Key Manager | >= 5.10.0, < 5.10.0.363 |
| WSO2 | org.wso2.carbon.mediation:org.wso2.carbon.localentry | >= 4.7.30, < 4.7.30.46; >= 4.7.61, < 4.7.61.61; >= 4.7.99, < 4.7.99.303; >= 4.7.131, < 4.7.131.21; >= 4.7.175, < 4.7.175.29; >= 4.7.188, < 4.7.188.11; >= 4.7.204, < 4.7.204.12; >= 4.7.221, < 4.7.221.6; >= 4.7.245, < 4.7.245.6 |
References
Timeline
- Published
- Nov 5, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed