CVE-2024-4412lowCWE-94

CVE-2024-4412: fallo de gravedad baja en WSO2 API Manager

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WSO2 API Manager+ Monitorear WSO2 Identity Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

8Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 2.7epss 0.4%
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Productos afectados
WSO2 · WSO2 API ManagerWSO2 · WSO2 Carbon Identity Application Authentication FrameworkWSO2 · WSO2 Carbon Identity Recovery ManagementWSO2 · WSO2 Carbon Identity User StoreWSO2 · WSO2 Carbon Identity User Store ConfigurationWSO2 · WSO2 Carbon Identity User Store Configuration UIWSO2 · WSO2 Enterprise IntegratorWSO2 · WSO2 Identity ServerWSO2 · WSO2 Identity Server as Key ManagerWSO2 · WSO2 Open Banking AMWSO2 · WSO2 Open Banking IAM
CVEs relacionadas — WSO2 API Manager

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-5430CRITICALAuthentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account TakeoverEPSS 22.4%KEVCVE-2024-7074MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code ExecutionEPSS 17.7%CVE-2025-2905CRITICALAn XML External Entity (XXE) vulnerability in Multiple WSO2 ProductsEPSS 1.3%CVE-2025-3125MEDIUMAuthenticated Arbitrary File Upload in Multiple WSO2 Products via CarbonAppUploader Admin Service Leading to Remote Code ExecutionEPSS 0.9%CVE-2025-5605MEDIUMAuthentication Bypass via URI Manipulation in Multiple WSO2 Products' Management Console Leading to Partial Information DisclosureEPSS 0.9%CVE-2025-10611CRITICALPotential Broken Access Control in Multiple WSO2 Products via System REST APIsEPSS 0.8%