CVE-2025-10713: WSO2 Carbon Mediation XML External Entity (XXE) Vulnerability
Summary
CVE-2025-10713: WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks. Affects org.wso2.carbon.mediation:org.wso2.carbon.localentry versions 4.6.100 – 4.7.99. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WSO2 Carbon Mediation is a powerful integration platform that allows developers to create and manage mediation flows for various services. It provides features such as message transformation, routing, and protocol bridging. However, due to improper configuration of the XML parser, it is susceptible to XML External Entity (XXE) attacks, which can compromise the security of the application.
Vulnerability Detail
An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote, unauthenticated attacker to read sensitive files from the server's filesystem or perform denial-of-service (DoS) attacks that render affected services unavailable. This vulnerability is classified under CWE-611 and has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the parsing of external entities in your XML parser configuration. Ensure that your XML parser is set to not resolve external entities by configuring it as follows:
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Conclusion
The XML External Entity (XXE) vulnerability in WSO2 Carbon Mediation poses significant risks to applications that utilize this platform. It is crucial to update to the patched version or implement the recommended workarounds to mitigate potential attacks. Regular monitoring with tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for org.wso2.carbon.mediation:org.wso2.carbon.localentry →
FAQ
An XXE attack occurs when an XML parser processes external entities, allowing attackers to read files on the server or execute other malicious actions.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's pom.xml against the vulnerability using the Vulert playground at Vulert Scanner.
The vulnerability can lead to unauthorized access to sensitive files and potential denial-of-service attacks, affecting the availability of your services.
Yes, the patched version of the affected package is 4.7.259 or later. It is recommended to update to this version.
If immediate updates are not possible, implement the provided workaround to disable external entity parsing in your XML configuration.
