CVE-2025-10713
Published: 05 November 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2025-10713 is an XML External Entity (XXE) vulnerability, mapped to CWE-611, affecting multiple WSO2 products. The issue arises from improper configuration of the XML parser, which processes user-supplied XML input without sufficient restrictions on external entity resolution. Published on 2025-11-05T18:15:32.247, it carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H).
A remote, unauthenticated attacker can exploit this vulnerability by submitting malicious XML payloads. Successful exploitation enables the attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable, with high impacts on confidentiality and availability.
The primary advisory from WSO2 is available at https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2025-4505/, which security practitioners should review for detailed mitigation guidance, patches, and affected product versions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
XXE vulnerability in public-facing WSO2 products enables exploitation of public-facing application (T1190), arbitrary file reads from server filesystem (T1005), and DoS via entity expansion (T1499.004).