Wso2 Identity Server Keystore Rest Api Commons
Monthly
Information disclosure in WSO2 Identity Server's Keystore REST API lets remote attackers learn the server-side file paths of certificate files by sending a request whose content-type header the component fails to validate. The affected code spans the Keystore REST API commons and v1 modules, and the same component ships in WSO2 Identity Server, Identity Server as Key Manager and Open Banking IAM. The exposure is limited to path strings rather than certificate contents, private keys or credentials, and no public exploit has been identified at time of analysis; the vendor rated it 5.8 with Scope:Changed, while the independent assessment treats scope as unchanged and scores confidentiality-only, low impact.
Information disclosure in WSO2 Identity Server's Keystore REST API lets remote attackers learn the server-side file paths of certificate files by sending a request whose content-type header the component fails to validate. The affected code spans the Keystore REST API commons and v1 modules, and the same component ships in WSO2 Identity Server, Identity Server as Key Manager and Open Banking IAM. The exposure is limited to path strings rather than certificate contents, private keys or credentials, and no public exploit has been identified at time of analysis; the vendor rated it 5.8 with Scope:Changed, while the independent assessment treats scope as unchanged and scores confidentiality-only, low impact.