CVE-2024-4412Low· 2.7▾ SunlitThe software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 14.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.
Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
enterprise_integrator >= 6.6.0 < 6.6.0.205api_manager >= 3.1.0 < 3.1.0.276api_manager >= 3.2.0 < 3.2.0.366api_manager >= 3.2.1 < 3.2.1.18api_manager >= 4.0.0 < 4.0.0.307api_manager >= 4.1.0 < 4.1.0.169api_manager >= 4.2.0 < 4.2.0.108api_manager >= 4.3.0 < 4.3.0.20open_banking_iam >= 2.0.0 < 2.0.0.346identity_server >= 5.10.0 < 5.10.0.297identity_server >= 5.11.0 < 5.11.0.337identity_server >= 6.0.0 < 6.0.0.189identity_server >= 6.1.0 < 6.1.0.149identity_server >= 7.0.0 < 7.0.0.15identity_server_as_key_manager >= 5.10.0 < 5.10.0.293open_banking_am >= 2.0.0 < 2.0.0.326org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.14.127 < 5.14.127.8org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.5 < 5.17.5.266org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.118 < 5.17.118.6org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.187 < 5.18.187.253org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.248 < 5.18.248.20org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.23.8 < 5.23.8.178org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.24.8 < 5.24.8.9org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.92 < 5.25.92.81org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.705 < 5.25.705.8org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 7.0.78 < 7.0.78.12org.wso2.carbon.identity.user.store.configuration >= 5.14.127 < 5.14.127.8org.wso2.carbon.identity.user.store.configuration >= 5.17.5 < 5.17.5.266org.wso2.carbon.identity.user.store.configuration >= 5.17.118 < 5.17.118.6org.wso2.carbon.identity.user.store.configuration >= 5.18.187 < 5.18.187.253org.wso2.carbon.identity.user.store.configuration >= 5.18.248 < 5.18.248.20org.wso2.carbon.identity.user.store.configuration >= 5.23.8 < 5.23.8.178org.wso2.carbon.identity.user.store.configuration >= 5.24.8 < 5.24.8.9org.wso2.carbon.identity.user.store.configuration >= 5.25.92 < 5.25.92.81org.wso2.carbon.identity.user.store.configuration >= 5.25.705 < 5.25.705.8org.wso2.carbon.identity.user.store.configuration >= 7.0.78 < 7.0.78.12org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.72 < 1.4.72.66org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.100 < 1.4.100.6org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.7.2 < 1.7.2.2org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.8.107 < 1.8.107.1org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.18.248 < 5.18.248.20org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.24.8 < 5.24.8.9org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.25.705 < 5.25.705.8org.wso2.carbon.identity.api.server.userstore.v1 >= 1.0.190 < 1.0.190.14org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.3 < 1.2.3.4org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.23 < 1.2.23.4Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-4457NoneRemote Code Execution via JDBC User Store Configuration in Multiple WSO2 Products Allows Arbitrary Code Execution
CVE-2024-8008Medium· 5.2Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation
CVE-2025-12107High· 8.4The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input
CVE-2025-7043Medium· 5.4Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
CVE-2025-6623Medium· 4.3Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
CVE-2025-7203Medium· 4.9Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials