All vulnerabilities
CVE-2025-7203

Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

WSO2 WSO2 Universal GatewayNetwork & edge
Open in ThreatlineRecord JSON
CVSS
4.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.5.0.46Also 4.6.0.14, 4.5.0.45 and 12 moreCVE List
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

Show all 22 fixed versions
  • 4.3.0.97WSO2 API ManagerCVE List
  • 4.4.0.61WSO2 API ManagerCVE List
  • 4.5.0.46WSO2 API ManagerCVE List
  • 4.6.0.14WSO2 API ManagerCVE List
  • 7.0.0.111WSO2 Identity ServerCVE List
  • 7.1.0.19WSO2 Identity ServerCVE List
  • 4.9.11.4WSO2 Carbon Secured HTTP Log4j2 AppenderCVE List
  • 4.9.18.2WSO2 Carbon Secured HTTP Log4j2 AppenderCVE List
  • 4.10.9.2WSO2 Carbon Secured HTTP Log4j2 AppenderCVE List
  • 4.10.19.1WSO2 Carbon Secured HTTP Log4j2 AppenderCVE List
  • 4.9.11.4WSO2 Carbon Logging ServicesCVE List
  • 4.9.18.2WSO2 Carbon Logging ServicesCVE List
  • 4.10.9.2WSO2 Carbon Logging ServicesCVE List
  • 4.10.19.1WSO2 Carbon Logging ServicesCVE List
  • 1.2.176.16WSO2 Carbon Identity API Server Configs V1CVE List
  • 1.3.83.7WSO2 Carbon Identity API Server Configs V1CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled.

An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server.

Text from CVE List

Affected versions 28

  • WSO2 Universal Gatewayunknown: all versions before 4.5.0CVE List
  • WSO2 Universal Gatewayaffected: 4.5.0 before 4.5.0.46CVE List
  • WSO2 Universal Gatewayaffected: 4.6.0 before 4.6.0.14CVE List
  • WSO2 Traffic Managerunknown: all versions before 4.5.0CVE List
  • WSO2 Traffic Manageraffected: 4.5.0 before 4.5.0.45CVE List
  • WSO2 Traffic Manageraffected: 4.6.0 before 4.6.0.14CVE List
  • WSO2 API Control Planeunknown: all versions before 4.5.0CVE List
  • WSO2 API Control Planeaffected: 4.5.0 before 4.5.0.47CVE List
  • WSO2 API Control Planeaffected: 4.6.0 before 4.6.0.15CVE List
  • WSO2 API Managerunknown: all versions before 4.3.0CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.97CVE List
  • WSO2 API Manageraffected: 4.4.0 before 4.4.0.61CVE List
  • WSO2 API Manageraffected: 4.5.0 before 4.5.0.46CVE List
  • WSO2 API Manageraffected: 4.6.0 before 4.6.0.14CVE List
  • WSO2 Identity Serverunknown: all versions before 7.0.0CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.111CVE List
  • WSO2 Identity Serveraffected: 7.1.0 before 7.1.0.19CVE List
  • WSO2 Carbon Secured HTTP Log4j2 Appenderaffected: 4.9.11 before 4.9.11.4CVE List
  • WSO2 Carbon Secured HTTP Log4j2 Appenderaffected: 4.9.18 before 4.9.18.2CVE List
  • WSO2 Carbon Secured HTTP Log4j2 Appenderaffected: 4.10.9 before 4.10.9.2CVE List
  • WSO2 Carbon Secured HTTP Log4j2 Appenderaffected: 4.10.19 before 4.10.19.1CVE List
  • WSO2 Carbon Logging Servicesaffected: 4.9.11 before 4.9.11.4CVE List
  • WSO2 Carbon Logging Servicesaffected: 4.9.18 before 4.9.18.2CVE List
  • WSO2 Carbon Logging Servicesaffected: 4.10.9 before 4.10.9.2CVE List
  • WSO2 Carbon Logging Servicesaffected: 4.10.19 before 4.10.19.1CVE List
  • WSO2 Carbon Logging Servicesunaffected: xCVE List
  • WSO2 Carbon Identity API Server Configs V1affected: 1.2.176 before 1.2.176.16CVE List
  • WSO2 Carbon Identity API Server Configs V1affected: 1.3.83 before 1.3.83.7CVE List

References 1