جزئیات آسیب‌پذیری
CVE-2025-13647
WSO2 Identity ServerWSO2 Identity Server Keystore Rest API CommonsWSO2 Identity Server Keystore Rest API V1WSO2 Identity Server as Key ManagerWSO2 Open Banking IAM
Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
CVSS 3.1
5.8متوسط
نمای کلی
اکسپلویت‌های عمومی
اخبار مرتبط
خط زمانی
خلاصه‌ی فارسی
خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.
شرح رسمی (انگلیسی)
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 5.8متوسط | 3.1 | CVEProject cvelistV5 (CNA) (WSO2) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| WSO2 | WSO2 Identity Server | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.381 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 5.11.0 ≤ v < 5.11.0.428 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.0.0 ≤ v < 6.0.0.255 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 6.1.0 ≤ v < 6.1.0.255 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.0.0 ≤ v < 7.0.0.133 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.1.0 ≤ v < 7.1.0.41 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server | 7.2.0 ≤ v < 7.2.0.3 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API Commons | 1.0.190 ≤ v < 1.0.190.17 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API Commons | 1.0.82 ≤ v < 1.0.82.25 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API Commons | 1.2.176 ≤ v < 1.2.176.18 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API Commons | 1.2.23 ≤ v < 1.2.23.10 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API Commons | 1.2.3 ≤ v < 1.2.3.6 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API Commons | 1.3.213 ≤ v < 1.3.213.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API Commons | 1.3.83 ≤ v < 1.3.83.10 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API V1 | 1.0.190 ≤ v < 1.0.190.17 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API V1 | 1.0.82 ≤ v < 1.0.82.25 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API V1 | 1.2.176 ≤ v < 1.2.176.18 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API V1 | 1.2.23 ≤ v < 1.2.23.10 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API V1 | 1.2.3 ≤ v < 1.2.3.6 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API V1 | 1.3.213 ≤ v < 1.3.213.1 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server Keystore Rest API V1 | 1.3.83 ≤ v < 1.3.83.10 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | v < 5.10.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.372 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | v < 2.0.0 | CVEProject cvelistV5 (CNA) |
| WSO2 | WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.421 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۱اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۸/۱۱
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۸/۱۱
- وضعیت
- PUBLISHED
- صادرکننده (CNA)
- WSO2
- اولویت کلون
- به‌زودی
پیش‌بینی بهره‌برداری (EPSS)
۰٫۱۸٪
احتمال بهره‌برداری در ۳۰ روز
۷٫۹٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- Automatable
- yes
- Exploitation
- none
- Technical Impact
- partial
ضعف‌ها (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor