XML External Entity Vulnerability in WSO2 Products
CVE-2025-10713

6.5MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Enterprise Integrator
Wso2 Api Control Plane
Wso2 Universal Gateway
Wso2 Traffic Manager
Vendor
CVE Published:
5 November 2025

What is CVE-2025-10713?

The vulnerability in multiple WSO2 products arises from improper configuration of the XML parser, allowing the application to parse user-provided XML without adequate restrictions. This weakness can be exploited by attackers to resolve external entities, potentially leading to unauthorized access to sensitive files on the server. Furthermore, the attacker could launch denial-of-service (DoS) attacks, causing critical services to become unavailable. It's crucial for organizations using affected WSO2 products to review their configurations and apply necessary security patches to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

org.wso2.carbon.mediation:org.wso2.carbon.localentry 4.7.30 < 4.7.30.46

org.wso2.carbon.mediation:org.wso2.carbon.localentry 4.7.61 < 4.7.61.61

org.wso2.carbon.mediation:org.wso2.carbon.localentry 4.7.99 < 4.7.99.303

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

crnković
JSON
.