Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-4989— Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

Quick assessment

Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WSO2 API Manager 中的回调 URL 参数未能验证用户提供的输入，导致该参数可被恶意攻击者操控。 利用此漏洞可能导致用户被重定向至由攻击者控制的网页。攻击者可结合社会工程学手段，诱骗用户点击恶意链接，从而实施网络钓鱼攻击，窃取敏感信息或造成其他危害。

CVSS 5.4 · Medium

Affected Version Matrix 4

VendorProduct Version RangeStatus
WSO2 WSO2 API Manager < 4.1.0 unknown
4.1.0< 4.1.0.153 affected
4.2.0< 4.2.0.105 affected
4.3.0< 4.3.0.20 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-4989

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
Source: CVE Program / CVE List V5
Vulnerability Description
The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Manager 4.1.0 ~ 4.1.0.153 -

II. Public POCs for CVE-2024-4989

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-4989

请登录查看更多情报信息。

Patches & Fixes for CVE-2024-4989 (1)

Vendor Advisories for CVE-2024-4989 (1)

Same Patch Batch · WSO2 · 2026-10-21 · 6 CVEs total

CVE-2024-5139 6.1 MEDIUM Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Mani
CVE-2024-7478 5.8 MEDIUM Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Accoun
CVE-2024-5563 4.8 MEDIUM Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows
CVE-2024-6423 4.0 MEDIUM Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential I
CVE-2025-0326 Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

IV. Related Vulnerabilities

Same product: WSO2 API Manager
Same vendor: WSO2
Same weakness: CWE-601

V. Comments for CVE-2024-4989

No comments yet

Leave a comment