Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-47293
CVE-2025-47293:
Java vulnerability analysis and mitigation
Overview
PowSyBl (Power System Blocks), a framework for building power system oriented software, was found to contain XML external entity (XXE) and server-side request forgery (SSRF) vulnerabilities in versions prior to 6.7.2. The vulnerability was discovered and disclosed on June 19, 2025, affecting the XML parsing functionality in powsybl-core, specifically the com.powsybl.commons.xml.XmlReader class (GitHub Advisory).
Technical details
The vulnerability exists in the XML parsing functionality where the XmlReader class processes untrusted XML input. The issue received a CVSS v4.0 score of 2.7 (LOW) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U. The vulnerability is tracked under two CWE categories: CWE-611 (Improper Restriction of XML External Entity Reference) and CWE-918 (Server-Side Request Forgery) (NVD).
Impact
The vulnerability allows attackers to elevate their privileges and read files they don't have permissions to access, including sensitive system files. This is particularly concerning in multi-tenant applications where different users have different privilege levels. The vulnerability is especially critical when the application allows untrusted users to import untrusted CGMES or XIIDM network files (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in PowSyBl Core version 6.7.2. Users are strongly advised to upgrade to this version or later. The fix involves adding security properties to the XMLReader implementation (GitHub Release).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management