The vulnerability arises when an Event Publisher output adapter in WSO2 API Manager is configured with irrelevant properties that get logged without sufficient validation or sanitization. This improper logging can expose sensitive information in the 'wso2carbon' log files. An attacker with access to these log files could retrieve confidential data, potentially leading to unauthorized access. The vulnerability affects multiple specific versions of WSO2 API Manager, including 3.1.0, 3.2.0, 3.2.1, and versions 4.1.0 through 4.6.0. There is no vendor advisory or patch information available, and no known exploits in the wild have been reported.

Sensitive information such as user credentials or other confidential data may be exposed in log files due to improper logging of Event Publisher output adapter properties. This exposure could allow an attacker with access to the 'wso2carbon' log files to gain unauthorized access or compromise confidentiality. The vulnerability does not impact integrity or availability directly. The attack vector requires local access to the log files and high privileges, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should carefully review and restrict configurations of Event Publisher output adapters to avoid logging sensitive information. Access to 'wso2carbon' log files should be tightly controlled to prevent unauthorized reading. Monitor vendor communications for updates on patches or official mitigations.