WSO2 Identity Server CVE-2025-13647

Exploitation requires network access to an exposed WSO2 keystore REST API endpoint (the Keystore REST API commons/v1 components) and the ability to send a request carrying a manipulated content-type header that the component fails to validate; per the CVSS vector (PR:N) no authentication is indicated. What limits impact: the outcome is confined to disclosure of certificate file paths - not file contents, keys, or credentials - so the flaw yields reconnaissance data rather than direct access, and its usefulness depends on the attacker being able to reach the affected API over the network. The exact triggering content-type value and whether non-default configuration is required are not described in the available sources.

This is a moderate-severity information-disclosure issue, not an urgent priority. The supplied CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, base 5.8) indicates a network-reachable, low-complexity, unauthenticated flaw with only a low confidentiality impact and no integrity or availability impact - consistent with disclosure of certificate file paths rather than file contents or credentials. The vuln.today decision label is 'this_month,' signaling a routine patch cadence rather than emergency action. No EPSS score, no CISA KEV listing, and no POC or exploit reference are present in the input, so there is no public evidence of active or imminent exploitation. The scope-change flag (S:C) in the input raises the score modestly, but the actual harm is limited: leaked filesystem paths to certificate files are reconnaissance value that could aid subsequent attacks, not a direct compromise. Overall this is a genuine but low-to-moderate priority finding - patch on a normal maintenance schedule; it is not a high-CVSS-but-illusory issue, nor is it an emergency.

A remote attacker sends a crafted HTTP request to an exposed WSO2 Identity Server keystore REST API endpoint with a manipulated content-type header that evades the expected validation. The weak validation causes the application to return an error or response that reveals the server-side file paths of certificate files, which the attacker records for use in later, more targeted attacks. No public exploit code or POC reference is provided in the available sources.