cve/2025/CVE-2025-2905.md
2025-09-29 21:09:30 +02:00

1.2 KiB
Raw Blame History

CVE-2025-2905

Description

An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.This vulnerability can be exploited by an unauthenticated remote attacker to read files from the servers filesystem or perform denial-of-service (DoS) attacks. * On systems running JDK 7 or early JDK 8, full file contents may be exposed. * On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior. * DoS attacks such as "Billion Laughs" payloads can cause service disruption.

POC

Reference

No PoCs from references.

Github