Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-4412— Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Quick assessment

Affected
WSO2 WSO2 Enterprise Integrator
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

该软件在未进行充分验证的情况下接受用户提供的数据，导致攻击者可以注入恶意的表达式语言（EL）代码。这可能使攻击者在受影响的部署环境中执行任意操作。 利用此漏洞需要管理员权限。由于 EL 的使用被限制在特定的只读操作上，因此该漏洞的影响程度较小。

CVSS 2.7 · Low

Affected Version Matrix 52

VendorProduct Version RangeStatus
WSO2 WSO2 API Manager < 3.1.0 unknown
3.1.0< 3.1.0.276 affected
3.2.0< 3.2.0.366 affected
3.2.1< 3.2.1.18 affected
4.0.0< 4.0.0.307 affected
4.1.0< 4.1.0.169 affected
4.2.0< 4.2.0.108 affected
4.3.0< 4.3.0.20 affected
WSO2 WSO2 Carbon Identity Application Authentication Framework 5.18.248< 5.18.248.20 affected
5.24.8< 5.24.8.9 affected
5.25.705< 5.25.705.8 affected
WSO2 WSO2 Carbon Identity Recovery Management 1.4.72< 1.4.72.66 affected
1.4.100< 1.4.100.6 affected
1.7.2< 1.7.2.2 affected
1.8.107< 1.8.107.1 affected
WSO2 WSO2 Carbon Identity User Store 1.0.190< 1.0.190.14 affected
1.2.3< 1.2.3.4 affected
1.2.23< 1.2.23.4 affected
WSO2 WSO2 Carbon Identity User Store Configuration 5.14.127< 5.14.127.8 affected
5.17.5< 5.17.5.266 affected
5.17.118< 5.17.118.6 affected
5.18.187< 5.18.187.253 affected
5.18.248< 5.18.248.20 affected
5.23.8< 5.23.8.178 affected
5.24.8< 5.24.8.9 affected
5.25.92< 5.25.92.81 affected
… +2 more rows
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.14.127< 5.14.127.8 affected
5.17.5< 5.17.5.266 affected
5.17.118< 5.17.118.6 affected
5.18.187< 5.18.187.253 affected
5.18.248< 5.18.248.20 affected
5.23.8< 5.23.8.178 affected
5.24.8< 5.24.8.9 affected
5.25.92< 5.25.92.81 affected
… +2 more rows
WSO2 WSO2 Enterprise Integrator < 6.6.0 unknown
6.6.0< 6.6.0.205 affected
WSO2 WSO2 Identity Server < 5.10.0 unknown
5.10.0< 5.10.0.297 affected
5.11.0< 5.11.0.337 affected
6.0.0< 6.0.0.189 affected
6.1.0< 6.1.0.149 affected
7.0.0< 7.0.0.15 affected
WSO2 WSO2 Identity Server as Key Manager < 5.10.0 unknown
5.10.0< 5.10.0.293 affected
WSO2 WSO2 Open Banking AM < 2.0.0 unknown
2.0.0< 2.0.0.326 affected
WSO2 WSO2 Open Banking IAM < 2.0.0 unknown
2.0.0< 2.0.0.346 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-4412

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
Source: CVE Program / CVE List V5
Vulnerability Description
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 Enterprise Integrator 6.6.0 ~ 6.6.0.205 -
WSO2 WSO2 API Manager 3.1.0 ~ 3.1.0.276 -
WSO2 WSO2 Open Banking IAM 2.0.0 ~ 2.0.0.346 -
WSO2 WSO2 Identity Server 5.10.0 ~ 5.10.0.297 -
WSO2 WSO2 Identity Server as Key Manager 5.10.0 ~ 5.10.0.293 -
WSO2 WSO2 Open Banking AM 2.0.0 ~ 2.0.0.326 -
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.14.127 ~ 5.14.127.8 -
WSO2 WSO2 Carbon Identity User Store Configuration 5.14.127 ~ 5.14.127.8 -
WSO2 WSO2 Carbon Identity Recovery Management 1.4.72 ~ 1.4.72.66 -
WSO2 WSO2 Carbon Identity Application Authentication Framework 5.18.248 ~ 5.18.248.20 -
WSO2 WSO2 Carbon Identity User Store 1.0.190 ~ 1.0.190.14 -

II. Public POCs for CVE-2024-4412

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-4412

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-4412 (3)

Vendor Advisories for CVE-2024-4412 (1)

Same Patch Batch · WSO2 · 2026-10-19 · 7 CVEs total

CVE-2025-10149 8.2 HIGH Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Tak
CVE-2025-13173 6.5 MEDIUM Improper Token Revocation via Session-Bound Token Flow in Multiple WSO2 Products Allows Un
CVE-2025-7043 5.4 MEDIUM Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Re
CVE-2025-13591 5.3 MEDIUM Username Enumeration via Authentication Endpoint in WSO2 Identity Server Allows User Accou
CVE-2025-7203 4.9 MEDIUM Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2
CVE-2025-6623 4.3 MEDIUM Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation

IV. Related Vulnerabilities

Same product: WSO2 Enterprise Integrator
Same vendor: WSO2
Same weakness: CWE-94

V. Comments for CVE-2024-4412

No comments yet

Leave a comment