PT-2025-21226 · Unknown · Bonigarcia Webdrivermanager

Titan Team · CVE-2025-4641 · Published 2025-05-14 · Updated 2025-05-19

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: bonigarcia webdrivermanager versions 1.0.0 through 6.0.2

Description: The issue is related to an Improper Restriction of XML External Entity Reference, allowing Data Serialization External Entities Blowup. This affects the XML parsing components and modules. The vulnerability is associated with the program files in src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java. It is estimated to affect systems on Windows, MacOS, and Linux.

Recommendations: For versions 1.0.0 through 6.0.2, update to version 6.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the XML parsing components and modules until the update can be applied.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-4641

GHSA-PWM3-776C-8Q7Q

Affected Products

Bonigarcia Webdrivermanager

References · 16

• https://nvd.nist.gov/vuln/detail/CVE-2025-4641 · Security Note
• https://osv.dev/vulnerability/GHSA-pwm3-776c-8q7q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4641 · Vendor Advisory
• https://github.com/bonigarcia/webdrivermanager/pull/1458 · Note
• https://github.com/bonigarcia/webdrivermanager · Note
• https://t.me/cvetracker/23855 · Telegram Post
• https://t.me/latest_high_impact_cve/2368 · Telegram Post
• https://twitter.com/syedaquib77/status/1923200034587410755 · Twitter Post
• https://twitter.com/fridaysecurity/status/1923178619368526153 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1923177776284135562 · Twitter Post
• https://twitter.com/CVEnew/status/1922765600574800018 · Twitter Post
• https://t.me/pentestingnews/61450 · Telegram Post
• https://twitter.com/CheckmarxZero/status/1924504616269381860 · Twitter Post
• https://twitter.com/CveFindCom/status/1922721843103887497 · Twitter Post
• https://twitter.com/Dinosn/status/1923235013207761269 · Twitter Post