Summaryinfo

A vulnerability was found in WSO2 API Manager up to 2.0.0 and classified as problematic. This issue affects some unknown processing of the component XML Parser. Such manipulation leads to xml external entity reference. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is listed as CVE-2025-2905. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, has been found in WSO2 API Manager up to 2.0.0. Affected by this issue is an unknown code of the component XML Parser. The manipulation with an unknown input leads to a xml external entity reference vulnerability. Using CWE to declare the problem leads to CWE-611. The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution. This vulnerability can be exploited by an unauthenticated remote attacker to read files from the server’s filesystem or perform denial-of-service (DoS) attacks. * On systems running JDK 7 or early JDK 8, full file contents may be exposed. * On later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior. * DoS attacks such as "Billion Laughs" payloads can cause service disruption.

The advisory is shared for download at security.docs.wso2.com. This vulnerability is handled as CVE-2025-2905 since 03/28/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/02/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Automation Software

Vendor

• WSO2

Name

• API Manager

Version

• 2.0

License

• commercial

Support

• end of life

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion