{"uuid": "69e21103-5de1-4461-8cbf-9e7b2cdb49fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2025-2905", "type": "seen", "source": "https://t.me/cvedetector/24449", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2905 - WSO2 API Manager XXE File Disclosure and Denial of Service Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2905 \nPublished : May 5, 2025, 9:15 a.m. | 2\u00a0hours, 3\u00a0minutes ago \nDescription : An XML External Entity (XXE) vulnerability exists in the gateway component of WSO2 API Manager due to insufficient validation of XML input in crafted URL paths. User-supplied XML is parsed without appropriate restrictions, enabling external entity resolution.  \n  \n  \nThis vulnerability can be exploited by an unauthenticated remote attacker to read files from the server\u2019s filesystem or perform denial-of-service (DoS) attacks.  \n  \n  \n  \n  *    \nOn systems running JDK 7 or early JDK 8, full file contents may be exposed.  \n  \n  \n  \n  \n  *    \nOn later versions of JDK 8 and newer, only the first line of a file may be read, due to improvements in XML parser behavior.  \n  \n  \n  \n  \n  *    \nDoS attacks such as \"Billion Laughs\" payloads can cause service disruption. \nSeverity: 9.1 | CRITICAL \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"05 May 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-05-05T13:22:06.000000Z"}