Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
Summary
| CVE | CVE-2025-13647 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-02 10:17:10 UTC |
| Updated | 2026-11-04 20:10:00 UTC |
| Description | The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system. |
Risk And Classification
Primary CVSS: v3.1 5.8 MEDIUM from ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
EPSS: 0.001830000 probability, percentile 0.079530000 (date 2026-11-04)
Problem Types: CWE-200 | CWE-200 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | Secondary | 5.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
| 3.1 | CNA | CVSS | 5.8 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
ChangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 Identity Server | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.10.0 5.10.0.381 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.11.0 5.11.0.428 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.0.0 6.0.0.255 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.1.0 6.1.0.255 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.0.0 7.0.0.133 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.1.0 7.1.0.41 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.2.0 7.2.0.3 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | affected 2.0.0 2.0.0.421 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.10.0 5.10.0.372 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | affected 1.0.82 1.0.82.25 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | affected 1.0.190 1.0.190.17 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | affected 1.2.3 1.2.3.6 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | affected 1.2.23 1.2.23.10 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | affected 1.2.176 1.2.176.18 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | affected 1.3.83 1.3.83.10 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | affected 1.3.213 1.3.213.1 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API Commons | unaffected 1.3.221 * custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | affected 1.0.82 1.0.82.25 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | affected 1.0.190 1.0.190.17 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | affected 1.2.3 1.2.3.6 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | affected 1.2.23 1.2.23.10 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | affected 1.2.176 1.2.176.18 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | affected 1.3.83 1.3.83.10 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | affected 1.3.213 1.3.213.1 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server Keystore Rest API V1 | unaffected 1.3.221 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2025-4751/#solution
There are currently no legacy QID mappings associated with this CVE.