Description
Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.
A successful XXE attack could allow a remote, unauthenticated attacker to: * Read sensitive files from the server’s filesystem. * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable.
Metrics
CVSS 3.1 9.1/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 API Manager | < 2.0.0; 2.1.0; 2.2.0; 2.5.0; 2.6.0; 3.0.0; 3.1.0; >= 4.0.0, < 4.0.0.311; >= 4.1.0, < 4.1.0.152; >= 4.2.0, < 4.2.0.122 |
| WSO2 | WSO2 Enterprise Integrator | 6.0.0; 6.1.0; 6.1.1; 6.2.0; 6.3.0; 6.4.0; 6.5.0; 6.6.0 |
| WSO2 | WSO2 Enterprise Service Bus | 4.9.0; 5.0.0 |
| WSO2 | WSO2 Micro integrator | 1.0.0; 1.1.0; >= 1.2.0, < 1.2.0.162; >= 4.0.0, < 4.0.0.132; >= 4.1.0, < 4.1.0.115; >= 4.2.0, < 4.2.0.112 |
| WSO2 | WSO2 Open Banking AM | 1.5.0 |
References
Timeline
- Published
- May 5, 2025
- Last modified
- Jun 17, 2026
- NVD status
- Modified