Wso2 Carbon Secured Http Log4J2 Appender
Monthly
Cleartext storage of remote log server credentials, truststore passwords, and keystore passwords in WSO2 API Manager and related WSO2 products lets high-privileged authenticated Management Console users or anyone with direct read access to product files recover secrets when remote logging is enabled. The flaw is medium severity (CVSS 4.9, CWE-312) and limited to confidentiality; it can enable manipulation of log entries and compromise of the remote log server after credentials are obtained. No public exploit was identified at time of analysis, and deployments without remote logging enabled are not exposed through this path.
Cleartext storage of remote log server credentials, truststore passwords, and keystore passwords in WSO2 API Manager and related WSO2 products lets high-privileged authenticated Management Console users or anyone with direct read access to product files recover secrets when remote logging is enabled. The flaw is medium severity (CVSS 4.9, CWE-312) and limited to confidentiality; it can enable manipulation of log entries and compromise of the remote log server after credentials are obtained. No public exploit was identified at time of analysis, and deployments without remote logging enabled are not exposed through this path.