Data Exposure in WSO2 Management Console and Product Files
CVE-2025-7203

4.9MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Universal Gateway
Wso2 Traffic Manager
Wso2 Api Control Plane
Wso2 Api Manager
Vendor
CVE Published:
19 October 2026

What is CVE-2025-7203?

The WSO2 Management Console and associated product files reveal sensitive credentials in plain text due to insufficient protection when the remote logging feature is enabled. Administrators or attackers with access to the Management Console can retrieve critical information, including remote log server credentials, truststore passwords, and keystore passwords. This can lead to unauthorized log entry manipulation and jeopardizes the confidentiality and integrity of the remote log server.

Affected Version(s)

WSO2 API Control Plane 4.5.0 < 4.5.0.47

WSO2 API Control Plane 4.6.0 < 4.6.0.15

WSO2 API Manager 4.3.0 < 4.3.0.97

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.