org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery vulnerabilities

CVEs whose affected-version data names the org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2024-4412Low· 2.7

today

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploit…

▾ SunlitWSO2 · WSO2 Enterprise Integratorvia CVEORG