This vulnerability arises when an Event Publisher output adapter in WSO2 API Manager is configured with irrelevant properties that get logged without sufficient validation or sanitization. As a result, sensitive information may be inserted into log files ('wso2carbon' logs). An attacker with access to these logs could extract confidential data, including user credentials, due to this improper logging behavior. The issue affects multiple specific versions of WSO2 API Manager, and no vendor advisory or patch information is provided to confirm remediation status.

Sensitive information such as user credentials or other confidential data may be exposed in log files due to improper logging of misconfigured Event Publisher properties. This exposure could lead to unauthorized access if an attacker gains access to the affected log files. The vulnerability does not impact system integrity or availability directly but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to 'wso2carbon' log files to trusted personnel only and review Event Publisher configurations to avoid logging sensitive information inadvertently.