The system fails to protect or obfuscate credentials in the Management Console and certain product files, allowing sensitive data such as remote log server, truststore, and keystore passwords to be read in plain text. An attacker with administrative console access or direct file access can obtain these credentials, enabling manipulation of log entries and compromising the confidentiality and integrity of the remote log server. This weakness is identified as CWE‑312, indicating that the application stores credentials in plaintext.

Products from the WSO2 suite are affected, including WSO2 API Control Plane, WSO2 API Manager, WSO2 Carbon Identity API Server Configs V1, WSO2 Carbon Logging Services, WSO2 Carbon Secured HTTP Log4j2 Appender, WSO2 Identity Server, WSO2 Traffic Manager, and WSO2 Universal Gateway. No specific affected version information is provided.

The CVSS score of 4.9 places this issue in the medium severity range, and the EPSS score is not available, making it unclear how frequently the flaw is actively exploited. Because the flaw requires administrative console access or direct file access, the attack surface is limited to users or processes with privileged or file system access, and the vulnerability is not listed in KEV. Nevertheless, an organization that has configuration files exposed or uses the remote logging feature should consider the risk moderate and prioritize patching or mitigation.