Read the docs
TI-2025-43998 Aliases CVE-2025-13647GHSA-wv4j-66fp-65fp

Information disclosure in WSO2 products exposes certificate file paths

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

WSO2 Identity Server, WSO2 Open Banking IAM, WSO2 Identity Server as Key Manager, and the WSO2 Identity Server Keystore Rest API Commons and V1 components are affected. The affected component fails to enforce validation on the content-type header when it processes certain requests (CWE-200). An unauthenticated remote attacker can send a crafted request with a manipulated content-type header to expose the file paths of certificate files, which could be used in later attacks.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Fix Fixed WSO2 Identity Server (WSO2): 5.10.0.381, 5.11.0.428, 6.0.0.255 +4WSO2 Open Banking IAM (WSO2): 2.0.0.421+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WSO2WSO2 Identity Server5.10.0 to before 5.10.0.381; 5.11.0 to before 5.11.0.428; 6.0.0 to before 6.0.0.255; 6.1.0 to before 6.1.0.255; 7.0.0 to before 7.0.0.133; 7.1.0 to before 7.1.0.41; 7.2.0 to before 7.2.0.35.10.0.381, 5.11.0.428, 6.0.0.255, 6.1.0.255, 7.0.0.133, 7.1.0.41, 7.2.0.3Patch availableCNA
WSO2WSO2 Open Banking IAM2.0.0 to before 2.0.0.4212.0.0.421Patch availableCNA
WSO2WSO2 Identity Server as Key Manager5.10.0 to before 5.10.0.3725.10.0.372Patch availableCNA
WSO2WSO2 Identity Server Keystore Rest API Commons1.0.82 to before 1.0.82.25; 1.0.190 to before 1.0.190.17; 1.2.3 to before 1.2.3.6; 1.2.23 to before 1.2.23.10; 1.2.176 to before 1.2.176.18; 1.3.83 to before 1.3.83.10; 1.3.213 to before 1.3.213.11.0.82.25, 1.0.190.17, 1.2.3.6, 1.2.23.10, 1.2.176.18, 1.3.83.10, 1.3.213.1, 1.3.221Patch availableCNA
WSO2WSO2 Identity Server Keystore Rest API V11.0.82 to before 1.0.82.25; 1.0.190 to before 1.0.190.17; 1.2.3 to before 1.2.3.6; 1.2.23 to before 1.2.23.10; 1.2.176 to before 1.2.176.18; 1.3.83 to before 1.3.83.10; 1.3.213 to before 1.3.213.11.0.82.25, 1.0.190.17, 1.2.3.6, 1.2.23.10, 1.2.176.18, 1.3.83.10, 1.3.213.1, 1.3.221Patch availableCNA
  • WSO2 Identity Server VendorWSO2 Affected 5.10.0 to before 5.10.0.381; 5.11.0 to before 5.11.0.428; 6.0.0 to before 6.0.0.255; 6.1.0 to before 6.1.0.255; 7.0.0 to before 7.0.0.133; 7.1.0 to before 7.1.0.41; 7.2.0 to before 7.2.0.3 Fixed in 5.10.0.381, 5.11.0.428, 6.0.0.255, 6.1.0.255, 7.0.0.133, 7.1.0.41, 7.2.0.3 Patch available CNA
  • WSO2 Open Banking IAM VendorWSO2 Affected 2.0.0 to before 2.0.0.421 Fixed in 2.0.0.421 Patch available CNA
  • WSO2 Identity Server as Key Manager VendorWSO2 Affected 5.10.0 to before 5.10.0.372 Fixed in 5.10.0.372 Patch available CNA
  • WSO2 Identity Server Keystore Rest API Commons VendorWSO2 Affected 1.0.82 to before 1.0.82.25; 1.0.190 to before 1.0.190.17; 1.2.3 to before 1.2.3.6; 1.2.23 to before 1.2.23.10; 1.2.176 to before 1.2.176.18; 1.3.83 to before 1.3.83.10; 1.3.213 to before 1.3.213.1 Fixed in 1.0.82.25, 1.0.190.17, 1.2.3.6, 1.2.23.10, 1.2.176.18, 1.3.83.10, 1.3.213.1, 1.3.221 Patch available CNA
  • WSO2 Identity Server Keystore Rest API V1 VendorWSO2 Affected 1.0.82 to before 1.0.82.25; 1.0.190 to before 1.0.190.17; 1.2.3 to before 1.2.3.6; 1.2.23 to before 1.2.23.10; 1.2.176 to before 1.2.176.18; 1.3.83 to before 1.3.83.10; 1.3.213 to before 1.3.213.1 Fixed in 1.0.82.25, 1.0.190.17, 1.2.3.6, 1.2.23.10, 1.2.176.18, 1.3.83.10, 1.3.213.1, 1.3.221 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:*——WSO2
  • cpe:2.3:a:wso2:identity_server:*:*:*:*:*:*:*:* Versions — — ·WSO2

Remediation

Update WSO2 Identity Server to 5.10.0.381, 5.11.0.428, 6.0.0.255, 6.1.0.255, 7.0.0.133, 7.1.0.41 or 7.2.0.3. Update WSO2 Open Banking IAM to 2.0.0.421 and WSO2 Identity Server as Key Manager to 5.10.0.372. Update WSO2 Identity Server Keystore Rest API Commons and WSO2 Identity Server Keystore Rest API V1 to 1.0.82.25, 1.0.190.17, 1.2.3.6, 1.2.23.10, 1.2.176.18, 1.3.83.10, 1.3.213.1 or 1.3.221.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA WSO2 Identity Server (WSO2) Fixed in 5.10.0.381, 5.11.0.428, 6.0.0.255, 6.1.0.255, 7.0.0.133, 7.1.0.41, 7.2.0.3
  • Fix · CNA WSO2 Open Banking IAM (WSO2) Fixed in 2.0.0.421
  • Fix · CNA WSO2 Identity Server as Key Manager (WSO2) Fixed in 5.10.0.372
  • Fix · CNA WSO2 Identity Server Keystore Rest API Commons (WSO2) Fixed in 1.0.82.25, 1.0.190.17, 1.2.3.6, 1.2.23.10, 1.2.176.18, 1.3.83.10, 1.3.213.1, 1.3.221
  • Fix · CNA WSO2 Identity Server Keystore Rest API V1 (WSO2) Fixed in 1.0.82.25, 1.0.190.17, 1.2.3.6, 1.2.23.10, 1.2.176.18, 1.3.83.10, 1.3.213.1, 1.3.221

Timeline

  1. 2026-11-02 Threatist record created from CVE-2025-13647
  2. 2026-11-02 Alias added: GHSA-wv4j-66fp-65fp
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2026-04755 Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-11928 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-18808 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. CVSS 3.1MEDIUM 6.1
  • TI-2020-15069 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0… CVSS 3.1CRITICAL 9.1
  • TI-2023-15163 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do… CVSS 3.1MEDIUM 6.1
  • TI-2022-04130 WSO2 carbon-registry Advanced Search advancedSearchForm-ajaxprocessor.jsp cross site scripting CVSS 3.1MEDIUM 6.1
See all 186 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences