PT-2025-45144 · Wso2 · Wso2 Products

Crnković · Published 2025-11-05 · Updated 2025-11-07 · CVE-2025-10713

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions WSO2 products (affected versions not specified)

Description An issue exists where the XML parser is improperly configured. The application processes user-provided XML data without adequate restrictions, potentially allowing the resolution of external entities. A remote, unauthenticated attacker could exploit this to read sensitive files from the server or cause a denial-of-service condition. The vulnerability involves improper configuration of the XML parser and the parsing of user-supplied XML data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-10713

GHSA-FVFQ-Q238-J7J3

Affected Products

Wso2 Products

References · 10

• https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4505 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvfq-q238-j7j3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10713 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10713 · Vendor Advisory
• https://github.com/wso2/carbon-mediation/commit/b995b2f1db96a4697791f0202cc8713f15640fd5 · Note
• https://github.com/wso2/carbon-mediation · Note
• https://github.com/wso2/carbon-mediation/pull/1784 · Note
• https://reddit.com/r/VulnMatter/comments/1oq8naq/resumen_diario_de_vulnerabilidades_06112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1oqv4uj/resumen_diario_de_vulnerabilidades_07112025 · Reddit Post
• https://t.me/CVEtracker/36631 · Telegram Post