CVE-2024-6423Medium· 4.0▾ SunlitThe product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.
If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
api_manager >= 3.1.0 < 3.1.0.313api_manager >= 3.2.0 < 3.2.0.406api_manager >= 3.2.1 < 3.2.1.30api_manager >= 4.0.0 < 4.0.0.324api_manager >= 4.1.0 < 4.1.0.185api_manager >= 4.2.0 < 4.2.0.124api_manager >= 4.3.0 < 4.3.0.36api_manager >= 4.4.0 < 4.4.0.2open_banking_am >= 2.0.0 < 2.0.0.363identity_server >= 5.10.0 < 5.10.0.337identity_server >= 5.11.0 < 5.11.0.384identity_server >= 6.0.0 < 6.0.0.213identity_server >= 6.1.0 < 6.1.0.211identity_server >= 7.0.0 < 7.0.0.50identity_server_as_key_manager >= 5.10.0 < 5.10.0.329open_banking_iam >= 2.0.0 < 2.0.0.381org.wso2.carbon.identity.application.authenticator.basicauth >= 6.3.0 < 6.3.0.18org.wso2.carbon.identity.application.authenticator.basicauth >= 6.3.11 < 6.3.11.23org.wso2.carbon.identity.application.authenticator.basicauth >= 6.3.58 < 6.3.58.1org.wso2.carbon.identity.application.authenticator.basicauth >= 6.5.0 < 6.5.0.5org.wso2.carbon.identity.application.authenticator.basicauth >= 6.6.0 < 6.6.0.1org.wso2.carbon.identity.application.authenticator.basicauth >= 6.7.8 < 6.7.8.4org.wso2.carbon.identity.application.authenticator.basicauth >= 6.7.32 < 6.7.32.1org.wso2.carbon.identity.core >= 5.17.5 < 5.17.5.286org.wso2.carbon.identity.core >= 5.17.118 < 5.17.118.11org.wso2.carbon.identity.core >= 5.18.187 < 5.18.187.263org.wso2.carbon.identity.core >= 5.18.248 < 5.18.248.23org.wso2.carbon.identity.core >= 5.23.8 < 5.23.8.189org.wso2.carbon.identity.core >= 5.24.8 < 5.24.8.12org.wso2.carbon.identity.core >= 5.25.92 < 5.25.92.91org.wso2.carbon.identity.core >= 5.25.92 < 5.25.92.118org.wso2.carbon.identity.core >= 5.25.705 < 5.25.705.11org.wso2.carbon.identity.core >= 5.25.713 < 5.25.713.2org.wso2.carbon.identity.core >= 7.0.78 < 7.0.78.27org.wso2.carbon.identity.oauth.common >= 6.4.2 < 6.4.2.142org.wso2.carbon.identity.oauth.common >= 6.4.176 < 6.4.176.20org.wso2.carbon.identity.oauth.common >= 6.4.180 < 6.4.180.8org.wso2.carbon.identity.oauth.common >= 6.8.0 < 6.8.0.40org.wso2.carbon.identity.oauth.common >= 6.9.6 < 6.9.6.16org.wso2.carbon.identity.oauth.common >= 6.11.21 < 6.11.21.44org.wso2.carbon.identity.oauth.common >= 6.13.16 < 6.13.16.6org.wso2.carbon.identity.oauth.common >= 6.13.19 < 6.13.19.2org.wso2.carbon.identity.oauth.common >= 7.0.26 < 7.0.26.18Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-4989Medium· 5.4Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
CVE-2024-7478Medium· 5.8Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery
CVE-2025-7043Medium· 5.4Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption
CVE-2025-6623Medium· 4.3Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
CVE-2025-13590Critical· 9.1Authenticated arbitrary file upload via a System REST API requiring administrator permission.
CVE-2026-3418Critical· 9.1Arbitrary File Upload via System REST API in Multiple WSO2 Products Allows Remote Code Execution