Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-12139— Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

Quick assessment

Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

该漏洞源于错误处理机制在特定条件下未能对用户通过 URL 参数提供的输入进行适当的清理或验证。这使得最终用户能够操控应用程序所显示的错误消息。 攻击者可利用此漏洞，在错误消息中注入任意内容。借此，他们能够实施社会工程学攻击（如网络钓鱼或凭证窃取），通过将合法的错误消息替换为恶意内容，诱骗用户泄露敏感信息或执行有害操作。

CVSS 4.3 · Medium

Affected Version Matrix 10

VendorProduct Version RangeStatus
WSO2 WSO2 API Manager < 3.2.1 unknown
3.2.1< 3.2.1.49 affected
4.1.0< 4.1.0.210 affected
4.2.0< 4.2.0.148 affected
WSO2 WSO2 Identity Server < 5.10.0 unknown
5.10.0< 5.10.0.346 affected
5.11.0< 5.11.0.385 affected
6.0.0< 6.0.0.229 affected
WSO2 WSO2 Identity Server as Key Manager < 5.10.0 unknown
5.10.0< 5.10.0.339 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-12139

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks
Source: CVE Program / CVE List V5
Vulnerability Description
The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Manager 3.2.1 ~ 3.2.1.49 -
WSO2 WSO2 Identity Server 5.10.0 ~ 5.10.0.346 -
WSO2 WSO2 Identity Server as Key Manager 5.10.0 ~ 5.10.0.339 -

II. Public POCs for CVE-2024-12139

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-12139

请登录查看更多情报信息。

Other References for CVE-2024-12139 (1)

Same Patch Batch · WSO2 · 2026-11-02 · 11 CVEs total

CVE-2025-11969 9.4 CRITICAL Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized A
CVE-2026-2613 8.7 HIGH SQL Injection via Admin REST API in Multiple WSO2 Products Allows Database Information Inf
CVE-2025-13647 5.8 MEDIUM Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
CVE-2024-2372 5.4 MEDIUM Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Atta
CVE-2024-9517 4.9 MEDIUM Improper Token Renewal in Refresh Token Grant in Multiple WSO2 Products Allows Unauthorize
CVE-2024-5617 4.8 MEDIUM Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute
CVE-2025-12544 4.8 MEDIUM Stored Cross-Site Scripting in Multiple WSO2 Products
CVE-2024-7075 4.6 MEDIUM Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple
CVE-2026-18800 4.4 MEDIUM Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrie
CVE-2024-12141 4.3 MEDIUM Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks

IV. Related Vulnerabilities

Same product: WSO2 API Manager
Same vendor: WSO2