CVE-2025-10713 json
XML External Entity (XXE) Vulnerability in Multiple WSO2 Products Due to Improper XML Parser Configuration
published 2025-11-05 12 mo ago modified 2026-09-10 1 mo ago also GHSA-fvfq-q238-j7j3 , EUVD-2025-37941
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities.
A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable.
Patch / fix
- WSO2 WSO2 Enterprise Integrator 6.6.0.223
- WSO2 WSO2 API Control Plane 4.5.0.27
- WSO2 WSO2 Universal Gateway 4.5.0.25
- WSO2 WSO2 Traffic Manager 4.5.0.25
- WSO2 WSO2 API Manager 3.1.0.344, 3.2.0.445, 3.2.1.65, 4.0.0.365, 4.1.0.227, 4.2.0.167, 4.3.0.79, 4.4.0.43, 4.5.0.26
- WSO2 WSO2 Identity Server 5.10.0.373, 5.11.0.417, 7.1.0.29
- WSO2 WSO2 Open Banking IAM 2.0.0.413
- WSO2 WSO2 Open Banking AM 2.0.0.393
- WSO2 WSO2 Identity Server as Key Manager 5.10.0.363
- WSO2 org.wso2.carbon.mediation:org.wso2.carbon.localentry 4.7.30.46, 4.7.61.61, 4.7.99.303, 4.7.131.21, 4.7.175.29, 4.7.188.11, 4.7.204.12, 4.7.221.6, 4.7.245.6, 4.7.259
- github.com/wso2/carbon-mediation@b995b2f commit
- github.com/wso2/carbon-mediation#1784 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 12 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.wso2.carbon.mediation:org.wso2.carbon.localentry | all versions |
no fix listed |
Affected products
- WSO2 WSO2 Enterprise Integrator
- WSO2 WSO2 API Control Plane
- WSO2 WSO2 Universal Gateway
- WSO2 WSO2 Traffic Manager
- WSO2 WSO2 API Manager
- WSO2 WSO2 Identity Server
- WSO2 WSO2 Open Banking IAM
- WSO2 WSO2 Open Banking AM
- WSO2 WSO2 Identity Server as Key Manager
- WSO2 org.wso2.carbon.mediation:org.wso2.carbon.localentry
Classification
- Weakness
-
- CWE-611 Improper Restriction of XML External Entity Reference
References
-
github.com
/wso2/carbon-mediation/pull/1784
web
-
github.com
/wso2/carbon-mediation/commit/b995b2f1db96a4697791f0202cc8713f15640fd5
web
-
security.docs.wso2.com
/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4505/
vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-10713
advisory
-
github.com
/wso2/carbon-mediation
package
-
security.docs.wso2.com
/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4505
web
Sources
- CVE List CVE-2025-10713
- GitHub Advisory GHSA-fvfq-q238-j7j3
- NVD CVE-2025-10713
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.