{"id":"CVE-2024-4412","title":"Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations","summary":"The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploit…","severity":"low","cvss":2.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-94"],"vendor":"WSO2","product":"WSO2 Enterprise Integrator","affected":["enterprise_integrator >= 6.6.0 < 6.6.0.205","api_manager >= 3.1.0 < 3.1.0.276","api_manager >= 3.2.0 < 3.2.0.366","api_manager >= 3.2.1 < 3.2.1.18","api_manager >= 4.0.0 < 4.0.0.307","api_manager >= 4.1.0 < 4.1.0.169","api_manager >= 4.2.0 < 4.2.0.108","api_manager >= 4.3.0 < 4.3.0.20","open_banking_iam >= 2.0.0 < 2.0.0.346","identity_server >= 5.10.0 < 5.10.0.297","identity_server >= 5.11.0 < 5.11.0.337","identity_server >= 6.0.0 < 6.0.0.189","identity_server >= 6.1.0 < 6.1.0.149","identity_server >= 7.0.0 < 7.0.0.15","identity_server_as_key_manager >= 5.10.0 < 5.10.0.293","open_banking_am >= 2.0.0 < 2.0.0.326","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.14.127 < 5.14.127.8","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.5 < 5.17.5.266","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.118 < 5.17.118.6","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.187 < 5.18.187.253","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.248 < 5.18.248.20","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.23.8 < 5.23.8.178","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.24.8 < 5.24.8.9","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.92 < 5.25.92.81","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.705 < 5.25.705.8","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 7.0.78 < 7.0.78.12","org.wso2.carbon.identity.user.store.configuration >= 5.14.127 < 5.14.127.8","org.wso2.carbon.identity.user.store.configuration >= 5.17.5 < 5.17.5.266","org.wso2.carbon.identity.user.store.configuration >= 5.17.118 < 5.17.118.6","org.wso2.carbon.identity.user.store.configuration >= 5.18.187 < 5.18.187.253","org.wso2.carbon.identity.user.store.configuration >= 5.18.248 < 5.18.248.20","org.wso2.carbon.identity.user.store.configuration >= 5.23.8 < 5.23.8.178","org.wso2.carbon.identity.user.store.configuration >= 5.24.8 < 5.24.8.9","org.wso2.carbon.identity.user.store.configuration >= 5.25.92 < 5.25.92.81","org.wso2.carbon.identity.user.store.configuration >= 5.25.705 < 5.25.705.8","org.wso2.carbon.identity.user.store.configuration >= 7.0.78 < 7.0.78.12","org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.72 < 1.4.72.66","org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.100 < 1.4.100.6","org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.7.2 < 1.7.2.2","org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.8.107 < 1.8.107.1","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.18.248 < 5.18.248.20","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.24.8 < 5.24.8.9","org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.25.705 < 5.25.705.8","org.wso2.carbon.identity.api.server.userstore.v1 >= 1.0.190 < 1.0.190.14","org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.3 < 1.2.3.4","org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.23 < 1.2.23.4"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T16:59:05.004Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-4412","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"},{"url":"https://github.com/wso2-extensions/identity-governance/pull/848"},{"url":"https://github.com/wso2/carbon-identity-framework/pull/5895"},{"url":"https://github.com/wso2/identity-apps/pull/6829"},{"url":"https://github.com/wso2/product-apim/pull/13524"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T17:33:42.457Z","slug":"CVE-2024-4412","body":"## Overview\n\nThe software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.\n\n## Affected\n\n- `enterprise_integrator >= 6.6.0 < 6.6.0.205`\n- `api_manager >= 3.1.0 < 3.1.0.276`\n- `api_manager >= 3.2.0 < 3.2.0.366`\n- `api_manager >= 3.2.1 < 3.2.1.18`\n- `api_manager >= 4.0.0 < 4.0.0.307`\n- `api_manager >= 4.1.0 < 4.1.0.169`\n- `api_manager >= 4.2.0 < 4.2.0.108`\n- `api_manager >= 4.3.0 < 4.3.0.20`\n- `open_banking_iam >= 2.0.0 < 2.0.0.346`\n- `identity_server >= 5.10.0 < 5.10.0.297`\n- `identity_server >= 5.11.0 < 5.11.0.337`\n- `identity_server >= 6.0.0 < 6.0.0.189`\n- `identity_server >= 6.1.0 < 6.1.0.149`\n- `identity_server >= 7.0.0 < 7.0.0.15`\n- `identity_server_as_key_manager >= 5.10.0 < 5.10.0.293`\n- `open_banking_am >= 2.0.0 < 2.0.0.326`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.14.127 < 5.14.127.8`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.5 < 5.17.5.266`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.118 < 5.17.118.6`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.187 < 5.18.187.253`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.248 < 5.18.248.20`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.23.8 < 5.23.8.178`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.24.8 < 5.24.8.9`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.92 < 5.25.92.81`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.705 < 5.25.705.8`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 7.0.78 < 7.0.78.12`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.14.127 < 5.14.127.8`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.17.5 < 5.17.5.266`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.17.118 < 5.17.118.6`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.18.187 < 5.18.187.253`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.18.248 < 5.18.248.20`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.23.8 < 5.23.8.178`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.24.8 < 5.24.8.9`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.25.92 < 5.25.92.81`\n- `org.wso2.carbon.identity.user.store.configuration >= 5.25.705 < 5.25.705.8`\n- `org.wso2.carbon.identity.user.store.configuration >= 7.0.78 < 7.0.78.12`\n- `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.72 < 1.4.72.66`\n- `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.100 < 1.4.100.6`\n- `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.7.2 < 1.7.2.2`\n- `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.8.107 < 1.8.107.1`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.18.248 < 5.18.248.20`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.24.8 < 5.24.8.9`\n- `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.25.705 < 5.25.705.8`\n- `org.wso2.carbon.identity.api.server.userstore.v1 >= 1.0.190 < 1.0.190.14`\n- `org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.3 < 1.2.3.4`\n- `org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.23 < 1.2.23.4`\n\n## Remediation\n\nFollow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution","depth":"sunlit","depthScore":15,"depthScoreParts":{"impact":14.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}