CVE-2025-7203: Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled.
An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server.
Affected Software
Event History
Frequently Asked Questions
Who can retrieve the exposed credentials?
An attacker needs either administrative access to the Management Console or direct access to the product files. The issue is therefore most relevant where administrative console access or filesystem access has already been obtained.
Is the remote logging feature required for exposure?
Yes. The described plaintext exposure occurs when the remote logging feature is enabled.
What credentials may be exposed?
Exposed data can include remote log server credentials, truststore passwords, and keystore passwords.
What could an attacker do with the retrieved credentials?
The credentials could enable manipulation of log entries and compromise the integrity and confidentiality of the remote log server.