--- id: CVE-2024-4412 title: >- Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations summary: >- The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploit… severity: low cvss: 2.7 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N' cvssSource: cna cwe: - CWE-94 vendor: WSO2 product: WSO2 Enterprise Integrator affected: - enterprise_integrator >= 6.6.0 < 6.6.0.205 - api_manager >= 3.1.0 < 3.1.0.276 - api_manager >= 3.2.0 < 3.2.0.366 - api_manager >= 3.2.1 < 3.2.1.18 - api_manager >= 4.0.0 < 4.0.0.307 - api_manager >= 4.1.0 < 4.1.0.169 - api_manager >= 4.2.0 < 4.2.0.108 - api_manager >= 4.3.0 < 4.3.0.20 - open_banking_iam >= 2.0.0 < 2.0.0.346 - identity_server >= 5.10.0 < 5.10.0.297 - identity_server >= 5.11.0 < 5.11.0.337 - identity_server >= 6.0.0 < 6.0.0.189 - identity_server >= 6.1.0 < 6.1.0.149 - identity_server >= 7.0.0 < 7.0.0.15 - identity_server_as_key_manager >= 5.10.0 < 5.10.0.293 - open_banking_am >= 2.0.0 < 2.0.0.326 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.14.127 < 5.14.127.8 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.5 < 5.17.5.266 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.118 < 5.17.118.6 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.187 < 5.18.187.253 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.248 < 5.18.248.20 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.23.8 < 5.23.8.178 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.24.8 < 5.24.8.9 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.92 < 5.25.92.81 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.705 < 5.25.705.8 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 7.0.78 < 7.0.78.12 - org.wso2.carbon.identity.user.store.configuration >= 5.14.127 < 5.14.127.8 - org.wso2.carbon.identity.user.store.configuration >= 5.17.5 < 5.17.5.266 - org.wso2.carbon.identity.user.store.configuration >= 5.17.118 < 5.17.118.6 - org.wso2.carbon.identity.user.store.configuration >= 5.18.187 < 5.18.187.253 - org.wso2.carbon.identity.user.store.configuration >= 5.18.248 < 5.18.248.20 - org.wso2.carbon.identity.user.store.configuration >= 5.23.8 < 5.23.8.178 - org.wso2.carbon.identity.user.store.configuration >= 5.24.8 < 5.24.8.9 - org.wso2.carbon.identity.user.store.configuration >= 5.25.92 < 5.25.92.81 - org.wso2.carbon.identity.user.store.configuration >= 5.25.705 < 5.25.705.8 - org.wso2.carbon.identity.user.store.configuration >= 7.0.78 < 7.0.78.12 - >- org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.72 < 1.4.72.66 - >- org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.100 < 1.4.100.6 - >- org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.7.2 < 1.7.2.2 - >- org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.8.107 < 1.8.107.1 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.18.248 < 5.18.248.20 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.24.8 < 5.24.8.9 - >- org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.25.705 < 5.25.705.8 - org.wso2.carbon.identity.api.server.userstore.v1 >= 1.0.190 < 1.0.190.14 - org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.3 < 1.2.3.4 - org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.23 < 1.2.23.4 published: '2026-10-19' updated: '2026-10-19' sourceUpdated: '2026-10-19T16:59:05.004Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-4412' references: - url: >- https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/ - url: 'https://github.com/wso2-extensions/identity-governance/pull/848' - url: 'https://github.com/wso2/carbon-identity-framework/pull/5895' - url: 'https://github.com/wso2/identity-apps/pull/6829' - url: 'https://github.com/wso2/product-apim/pull/13524' tags: - cve.org ingestedAt: '2026-10-19T17:33:42.457Z' --- ## Overview The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations. ## Affected - `enterprise_integrator >= 6.6.0 < 6.6.0.205` - `api_manager >= 3.1.0 < 3.1.0.276` - `api_manager >= 3.2.0 < 3.2.0.366` - `api_manager >= 3.2.1 < 3.2.1.18` - `api_manager >= 4.0.0 < 4.0.0.307` - `api_manager >= 4.1.0 < 4.1.0.169` - `api_manager >= 4.2.0 < 4.2.0.108` - `api_manager >= 4.3.0 < 4.3.0.20` - `open_banking_iam >= 2.0.0 < 2.0.0.346` - `identity_server >= 5.10.0 < 5.10.0.297` - `identity_server >= 5.11.0 < 5.11.0.337` - `identity_server >= 6.0.0 < 6.0.0.189` - `identity_server >= 6.1.0 < 6.1.0.149` - `identity_server >= 7.0.0 < 7.0.0.15` - `identity_server_as_key_manager >= 5.10.0 < 5.10.0.293` - `open_banking_am >= 2.0.0 < 2.0.0.326` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.14.127 < 5.14.127.8` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.5 < 5.17.5.266` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.17.118 < 5.17.118.6` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.187 < 5.18.187.253` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.18.248 < 5.18.248.20` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.23.8 < 5.23.8.178` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.24.8 < 5.24.8.9` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.92 < 5.25.92.81` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 5.25.705 < 5.25.705.8` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui >= 7.0.78 < 7.0.78.12` - `org.wso2.carbon.identity.user.store.configuration >= 5.14.127 < 5.14.127.8` - `org.wso2.carbon.identity.user.store.configuration >= 5.17.5 < 5.17.5.266` - `org.wso2.carbon.identity.user.store.configuration >= 5.17.118 < 5.17.118.6` - `org.wso2.carbon.identity.user.store.configuration >= 5.18.187 < 5.18.187.253` - `org.wso2.carbon.identity.user.store.configuration >= 5.18.248 < 5.18.248.20` - `org.wso2.carbon.identity.user.store.configuration >= 5.23.8 < 5.23.8.178` - `org.wso2.carbon.identity.user.store.configuration >= 5.24.8 < 5.24.8.9` - `org.wso2.carbon.identity.user.store.configuration >= 5.25.92 < 5.25.92.81` - `org.wso2.carbon.identity.user.store.configuration >= 5.25.705 < 5.25.705.8` - `org.wso2.carbon.identity.user.store.configuration >= 7.0.78 < 7.0.78.12` - `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.72 < 1.4.72.66` - `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.4.100 < 1.4.100.6` - `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.7.2 < 1.7.2.2` - `org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery >= 1.8.107 < 1.8.107.1` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.18.248 < 5.18.248.20` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.24.8 < 5.24.8.9` - `org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework >= 5.25.705 < 5.25.705.8` - `org.wso2.carbon.identity.api.server.userstore.v1 >= 1.0.190 < 1.0.190.14` - `org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.3 < 1.2.3.4` - `org.wso2.carbon.identity.api.server.userstore.v1 >= 1.2.23 < 1.2.23.4` ## Remediation Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution