CVE-2025-13647
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
72/100
Published: 2026-11-02
Modified: 2026-11-04
First seen: 2026-11-02
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Changed
C:
Low
I:
None
A:
None
Description
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.
Weakness Classification (1)
Affected Software (46)
Showing 30 of 46 entries
References & Advisories (1)
vendor-advisory