2 lines
5.5 KiB
JSON
2 lines
5.5 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"affected","version":"0","versionType":"custom"},{"status":"affected","version":"2.1.0","versionType":"custom"},{"status":"affected","version":"2.2.0","versionType":"custom"},{"status":"affected","version":"2.5.0","versionType":"custom"},{"status":"affected","version":"2.6.0","versionType":"custom"},{"status":"affected","version":"3.0.0","versionType":"custom"},{"status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"4.0.0.311","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.152","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.122","status":"affected","version":"4.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.0.0","status":"unknown","version":"0","versionType":"custom"},{"status":"affected","version":"6.0.0","versionType":"custom"},{"status":"affected","version":"6.1.0","versionType":"custom"},{"status":"affected","version":"6.1.1","versionType":"custom"},{"status":"affected","version":"6.2.0","versionType":"custom"},{"status":"affected","version":"6.3.0","versionType":"custom"},{"status":"affected","version":"6.4.0","versionType":"custom"},{"status":"affected","version":"6.5.0","versionType":"custom"},{"status":"affected","version":"6.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Service Bus","vendor":"WSO2","versions":[{"lessThan":"4.9.0","status":"unknown","version":"0","versionType":"custom"},{"status":"affected","version":"4.9.0","versionType":"custom"},{"status":"affected","version":"5.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Micro integrator","vendor":"WSO2","versions":[{"lessThan":"1.0.0","status":"unknown","version":"0","versionType":"custom"},{"status":"affected","version":"1.0.0","versionType":"custom"},{"status":"affected","version":"1.1.0","versionType":"custom"},{"lessThan":"1.2.0.162","status":"affected","version":"1.2.0","versionType":"custom"},{"lessThan":"4.0.0.132","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.115","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.112","status":"affected","version":"4.2.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"1.5.0","status":"unknown","version":"0","versionType":"custom"},{"status":"affected","version":"1.5.0","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"D867B74E-5FA8-46AF-86D2-FFD478CD5ACC","versionEndIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSO2 Products.\n\nA successful XXE attack could allow a remote, unauthenticated attacker to:\n * Read sensitive files from the server’s filesystem.\n * Perform denial-of-service (DoS) attacks, which can render the affected service unavailable."},{"lang":"es","value":"Existe una vulnerabilidad de Entidad Externa XML (XXE) en el componente de puerta de enlace de WSO2 API Manager debido a una validación insuficiente de la entrada XML en rutas URL manipulada. El XML proporcionado por el usuario se analiza sin las restricciones adecuadas, lo que permite la resolución de entidades externas. Esta vulnerabilidad puede ser explotada por un atacante remoto no autenticado para leer archivos del sistema de archivos del servidor o realizar ataques de denegación de servicio (DoS). * En sistemas con JDK 7 o versiones anteriores de JDK 8, el contenido completo de los archivos puede quedar expuesto. * En versiones posteriores de JDK 8 y posteriores, solo se puede leer la primera línea de un archivo, gracias a mejoras en el comportamiento del analizador XML. * Los ataques DoS, como los payloads \"Billion Laughs\", pueden causar interrupciones del servicio."}],"id":"CVE-2025-2905","lastModified":"2026-06-17T09:07:49.440","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"exploitabilityScore":3.9,"impactScore":5.2,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-2905","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-05-05T12:44:33.257401Z","version":"2.0.3"}}]},"published":"2025-05-05T09:15:15.923","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":["Vendor Advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-3993/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-611"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|