CVE-2025-4641
Last modified
CVE-2025-4641 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization External Entities Blowup. This vulnerability is associated with program files src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java. This issue affects webdrivermanager: from 1.0.0 before 6.0.2.. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization External Entities Blowup. This vulnerability is associated with program files src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java. This issue affects webdrivermanager: from 1.0.0 before 6.0.2.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-4641?
How severe is CVE-2025-4641?
How do I fix CVE-2025-4641?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-46404A denial of service vulnerability exists in the lasso_provid…7.5
- CVE-2025-46405When Network Access is configured on a BIG-IP APM virtual se…8.7
- CVE-2025-46406A Privilege Context Switching Error (CWE-270) in the Command…5.6
- CVE-2025-46407A memory corruption vulnerability exists in the BMPv3 Palett…8.8
- CVE-2025-46408An issue was discovered in the methods push.lite.avtech.com.…9.8
- CVE-2025-46409Inadequate encryption strength issue exists in SS1 Ver.16.0.…8.7
- CVE-2025-46410A cross-site scripting (xss) vulnerability exists in the man…6.1
- CVE-2025-46411A stack-based buffer overflow vulnerability exists in the MF…9.8
- CVE-2025-46412Affected Vertiv products do not properly protect webserver f…9.8
- CVE-2025-46413Use of password hash with insufficient computational effort …5.3
- CVE-2025-46414The affected product does not limit the number of attempts f…9.2
- CVE-2025-46415A race condition in the Nix, Lix, and Guix package managers …3.2
Are you affected by CVE-2025-4641?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST