WSO2 API Manager EUVD-2025-211117

Exploitation requires the remote logging feature to be ENABLED - on a WSO2 deployment without remote logging configured, no credentials are written to the exposed locations and the flaw does not apply. The attacker must additionally hold one of two prerequisites: administrative access to the WSO2 Management Console, OR direct (filesystem) read access to the product files/configuration on the server. These are strong limiting factors: this is a post-authentication / post-access disclosure, not a pre-auth exposure. The payoff is limited to confidentiality - plaintext remote log server credentials, truststore passwords, and keystore passwords - which then enables lateral compromise of the remote log server's integrity and confidentiality.

This is a genuine but lower-tier priority - a medium-severity (CVSS 4.9) cleartext credential storage flaw (CWE-312) whose exploitation is gated behind high privileges. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) tells the real story: the attack is network-reachable and low-complexity, but PR:H means the attacker must ALREADY hold administrative access to the WSO2 Management Console (or direct filesystem access to product files) before the flaw yields anything. The impact is purely confidentiality (C:H) - exposure of remote log server credentials, truststore and keystore passwords - with no direct integrity or availability loss to the WSO2 system itself. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation; the only intelligence source is the WSO2 vendor advisory itself. The signals are internally consistent (high-privilege confidentiality disclosure), so there is no CVSS-versus-description conflict to flag. Bottom line: a post-compromise credential-exposure / privilege-chaining issue useful to an attacker who already breached an admin account, not a standalone remote-takeover threat - patch it as part of routine maintenance rather than emergency response.

An attacker who has already obtained WSO2 Management Console administrative credentials (or read access to the product files on disk) browses the configuration or product files while the remote logging feature is enabled and reads the remote log server credentials, truststore, and keystore passwords stored in plain text. Armed with those secrets, they pivot to the remote log server to tamper with or forge log entries and access its protected data. No public exploit is required - the sensitive values are simply readable once admin/file access is held.