Strix
74.2K

CVE-2025-13647

MEDIUMCVSS 5.8/10EPSS 0.18%

Last modified

CVE-2025-13647 is a medium-severity vulnerability rated 5.8/10 on the CVSS scale. The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.

Metrics

CVSS 3.1
5.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

EPSS Probability
0.18%

8.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
WSO2WSO2 Identity Server< 5.10.0; >= 5.10.0, < 5.10.0.381; >= 5.11.0, < 5.11.0.428; >= 6.0.0, < 6.0.0.255; >= 6.1.0, < 6.1.0.255; >= 7.0.0, < 7.0.0.133; >= 7.1.0, < 7.1.0.41; >= 7.2.0, < 7.2.0.3
WSO2WSO2 Open Banking IAM< 2.0.0; >= 2.0.0, < 2.0.0.421
WSO2WSO2 Identity Server as Key Manager< 5.10.0; >= 5.10.0, < 5.10.0.372
WSO2WSO2 Identity Server Keystore Rest API Commons>= 1.0.82, < 1.0.82.25; >= 1.0.190, < 1.0.190.17; >= 1.2.3, < 1.2.3.6; >= 1.2.23, < 1.2.23.10; >= 1.2.176, < 1.2.176.18; >= 1.3.83, < 1.3.83.10; >= 1.3.213, < 1.3.213.1
WSO2WSO2 Identity Server Keystore Rest API V1>= 1.0.82, < 1.0.82.25; >= 1.0.190, < 1.0.190.17; >= 1.2.3, < 1.2.3.6; >= 1.2.23, < 1.2.23.10; >= 1.2.176, < 1.2.176.18; >= 1.3.83, < 1.3.83.10; >= 1.3.213, < 1.3.213.1

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2025-13647?
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.
How severe is CVE-2025-13647?
CVE-2025-13647 has a CVSS score of 5.8/10 (MEDIUM severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2025-13647?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-13647?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST