CVE-2024-6423 (GCVE-0-2024-6423)
Vulnerability from cvelistv5
Published
2026-10-21 13:56
Modified
2026-10-21 13:59
CWE
  • CWE-20 - Improper Input Validation
Summary
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
Impacted products
Vendor Product Version
WSO2 WSO2 API Manager Version: 3.1.0   < 3.1.0.313
Version: 3.2.0   < 3.2.0.406
Version: 3.2.1   < 3.2.1.30
Version: 4.0.0   < 4.0.0.324
Version: 4.1.0   < 4.1.0.185
Version: 4.2.0   < 4.2.0.124
Version: 4.3.0   < 4.3.0.36
Version: 4.4.0   < 4.4.0.2
Create a notification for this product.
   WSO2 WSO2 Open Banking AM Version: 2.0.0   < 2.0.0.363
Create a notification for this product.
   WSO2 WSO2 Identity Server Version: 5.10.0   < 5.10.0.337
Version: 5.11.0   < 5.11.0.384
Version: 6.0.0   < 6.0.0.213
Version: 6.1.0   < 6.1.0.211
Version: 7.0.0   < 7.0.0.50
Create a notification for this product.
   WSO2 WSO2 Identity Server as Key Manager Version: 5.10.0   < 5.10.0.329
Create a notification for this product.
   WSO2 WSO2 Open Banking IAM Version: 2.0.0   < 2.0.0.381
Create a notification for this product.
   WSO2 WSO2 Carbon Identity Application Version: 6.3.0   < 6.3.0.18
Version: 6.3.11   < 6.3.11.23
Version: 6.3.58   < 6.3.58.1
Version: 6.5.0   < 6.5.0.5
Version: 6.6.0   < 6.6.0.1
Version: 6.7.8   < 6.7.8.4
Version: 6.7.32   < 6.7.32.1
Patch: x
Create a notification for this product.
   WSO2 WSO2 Carbon Identity Core Version: 5.17.5   < 5.17.5.286
Version: 5.17.118   < 5.17.118.11
Version: 5.18.187   < 5.18.187.263
Version: 5.18.248   < 5.18.248.23
Version: 5.23.8   < 5.23.8.189
Version: 5.24.8   < 5.24.8.12
Version: 5.25.92   < 5.25.92.91
Version: 5.25.92   < 5.25.92.118
Version: 5.25.705   < 5.25.705.11
Version: 5.25.713   < 5.25.713.2
Version: 7.0.78   < 7.0.78.27
Patch: x
Create a notification for this product.
   WSO2 WSO2 Carbon Identity Oauth Version: 6.4.2   < 6.4.2.142
Version: 6.4.176   < 6.4.176.20
Version: 6.4.180   < 6.4.180.8
Version: 6.8.0   < 6.8.0.40
Version: 6.9.6   < 6.9.6.16
Version: 6.11.21   < 6.11.21.44
Version: 6.13.16   < 6.13.16.6
Version: 6.13.19   < 6.13.19.2
Version: 7.0.26   < 7.0.26.18
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.313",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.406",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.30",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.324",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.185",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.124",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.36",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.4.0.2",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.363",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.337",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.384",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.213",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.211",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.50",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.329",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.381",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.application.authenticator.basicauth",
          "product": "WSO2 Carbon Identity Application",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.3.0.18",
              "status": "affected",
              "version": "6.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.11.23",
              "status": "affected",
              "version": "6.3.11",
              "versionType": "custom"
            },
            {
              "lessThan": "6.3.58.1",
              "status": "affected",
              "version": "6.3.58",
              "versionType": "custom"
            },
            {
              "lessThan": "6.5.0.5",
              "status": "affected",
              "version": "6.5.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.1",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.8.4",
              "status": "affected",
              "version": "6.7.8",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.32.1",
              "status": "affected",
              "version": "6.7.32",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.core",
          "product": "WSO2 Carbon Identity Core",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.17.5.286",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.11",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.263",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.23",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.189",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.12",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.91",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.118",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.11",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.713.2",
              "status": "affected",
              "version": "5.25.713",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.27",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "x",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.oauth.common",
          "product": "WSO2 Carbon Identity Oauth",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.4.2.142",
              "status": "affected",
              "version": "6.4.2",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.176.20",
              "status": "affected",
              "version": "6.4.176",
              "versionType": "custom"
            },
            {
              "lessThan": "6.4.180.8",
              "status": "affected",
              "version": "6.4.180",
              "versionType": "custom"
            },
            {
              "lessThan": "6.8.0.40",
              "status": "affected",
              "version": "6.8.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.9.6.16",
              "status": "affected",
              "version": "6.9.6",
              "versionType": "custom"
            },
            {
              "lessThan": "6.11.21.44",
              "status": "affected",
              "version": "6.11.21",
              "versionType": "custom"
            },
            {
              "lessThan": "6.13.16.6",
              "status": "affected",
              "version": "6.13.16",
              "versionType": "custom"
            },
            {
              "lessThan": "6.13.19.2",
              "status": "affected",
              "version": "6.13.19",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.26.18",
              "status": "affected",
              "version": "7.0.26",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.0.313",
                  "versionStartIncluding": "3.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.0.406",
                  "versionStartIncluding": "3.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.1.30",
                  "versionStartIncluding": "3.2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.0.324",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.0.185",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.0.124",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0.36",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.4.0.2",
                  "versionStartIncluding": "4.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.363",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.337",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.0.384",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0.213",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.0.211",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.0.50",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.329",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.381",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.0.18",
                  "versionStartIncluding": "6.3.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.11.23",
                  "versionStartIncluding": "6.3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.58.1",
                  "versionStartIncluding": "6.3.58",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.0.5",
                  "versionStartIncluding": "6.5.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.0.1",
                  "versionStartIncluding": "6.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.8.4",
                  "versionStartIncluding": "6.7.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.32.1",
                  "versionStartIncluding": "6.7.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "*",
                  "versionStartIncluding": "x",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.286",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.11",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.263",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.23",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.189",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.12",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.91",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.118",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.11",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.713.2",
                  "versionStartIncluding": "5.25.713",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.27",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "*",
                  "versionStartIncluding": "x",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.2.142",
                  "versionStartIncluding": "6.4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.176.20",
                  "versionStartIncluding": "6.4.176",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.180.8",
                  "versionStartIncluding": "6.4.180",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.0.40",
                  "versionStartIncluding": "6.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.6.16",
                  "versionStartIncluding": "6.9.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.21.44",
                  "versionStartIncluding": "6.11.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.16.6",
                  "versionStartIncluding": "6.13.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.19.2",
                  "versionStartIncluding": "6.13.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.26.18",
                  "versionStartIncluding": "7.0.26",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
            }
          ],
          "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-246",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-246 CAPEC-246: Data Transmission"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T13:59:54.562Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2024-3465",
        "discovery": "INTERNAL"
      },
      "title": "Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-6423",
    "datePublished": "2026-10-21T13:56:26.552Z",
    "dateReserved": "2024-07-01T08:23:45.912Z",
    "dateUpdated": "2026-10-21T13:59:54.562Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…