Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-6423— Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

Quick assessment

Affected
WSO2 WSO2 API Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

该产品未对 URL 参数中的用户输入实施有效的验证约束，导致敏感数据可能被传递至本不应处理此类数据的流程。尽管该产品并未实际使用这些数据，但接受这些数据可能导致其被记录在日志中。 如果用户错误地通过 URL 参数将敏感数据发送至任意流程，该数据可能会被意外记录在访问日志中。这可能导致机密信息泄露，从而在误用该产品时，损害受影响系统的安全性与隐私性。

CVSS 4.0 · Medium

Possible ATT&CK Techniques 1 AI

T1040 · Network Sniffing

Affected Version Matrix 50

VendorProduct Version RangeStatus
WSO2 WSO2 API Manager < 3.1.0 unknown
3.1.0< 3.1.0.313 affected
3.2.0< 3.2.0.406 affected
3.2.1< 3.2.1.30 affected
4.0.0< 4.0.0.324 affected
4.1.0< 4.1.0.185 affected
4.2.0< 4.2.0.124 affected
4.3.0< 4.3.0.36 affected
… +1 more rows
WSO2 WSO2 Carbon Identity Application 6.3.0< 6.3.0.18 affected
6.3.11< 6.3.11.23 affected
6.3.58< 6.3.58.1 affected
6.5.0< 6.5.0.5 affected
6.6.0< 6.6.0.1 affected
6.7.8< 6.7.8.4 affected
6.7.32< 6.7.32.1 affected
x≤ * unaffected
WSO2 WSO2 Carbon Identity Core 5.17.5< 5.17.5.286 affected
5.17.118< 5.17.118.11 affected
5.18.187< 5.18.187.263 affected
5.18.248< 5.18.248.23 affected
5.23.8< 5.23.8.189 affected
5.24.8< 5.24.8.12 affected
5.25.92< 5.25.92.91 affected
5.25.92< 5.25.92.118 affected
… +4 more rows
WSO2 WSO2 Carbon Identity Oauth 6.4.2< 6.4.2.142 affected
6.4.176< 6.4.176.20 affected
6.4.180< 6.4.180.8 affected
6.8.0< 6.8.0.40 affected
6.9.6< 6.9.6.16 affected
6.11.21< 6.11.21.44 affected
6.13.16< 6.13.16.6 affected
6.13.19< 6.13.19.2 affected
… +1 more rows
WSO2 WSO2 Identity Server < 5.10.0 unknown
5.10.0< 5.10.0.337 affected
5.11.0< 5.11.0.384 affected
6.0.0< 6.0.0.213 affected
6.1.0< 6.1.0.211 affected
7.0.0< 7.0.0.50 affected
WSO2 WSO2 Identity Server as Key Manager < 5.10.0 unknown
5.10.0< 5.10.0.329 affected
WSO2 WSO2 Open Banking AM < 2.0.0 unknown
2.0.0< 2.0.0.363 affected
WSO2 WSO2 Open Banking IAM < 2.0.0 unknown
2.0.0< 2.0.0.381 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-6423

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
Source: CVE Program / CVE List V5
Vulnerability Description
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WSO2 WSO2 API Manager 3.1.0 ~ 3.1.0.313 -
WSO2 WSO2 Open Banking AM 2.0.0 ~ 2.0.0.363 -
WSO2 WSO2 Identity Server 5.10.0 ~ 5.10.0.337 -
WSO2 WSO2 Identity Server as Key Manager 5.10.0 ~ 5.10.0.329 -
WSO2 WSO2 Open Banking IAM 2.0.0 ~ 2.0.0.381 -
WSO2 WSO2 Carbon Identity Application 6.3.0 ~ 6.3.0.18 -
WSO2 WSO2 Carbon Identity Core 5.17.5 ~ 5.17.5.286 -
WSO2 WSO2 Carbon Identity Oauth 6.4.2 ~ 6.4.2.142 -

II. Public POCs for CVE-2024-6423

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-6423

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-6423 (1)

Same Patch Batch · WSO2 · 2026-10-21 · 6 CVEs total

CVE-2024-5139 6.1 MEDIUM Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Mani
CVE-2024-7478 5.8 MEDIUM Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Accoun
CVE-2024-4989 5.4 MEDIUM Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
CVE-2024-5563 4.8 MEDIUM Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows
CVE-2025-0326 Improper Token Revocation in WSO2 Identity Server Allows Unauthorized Access

IV. Related Vulnerabilities

Same product: WSO2 API Manager
Same vendor: WSO2
Same weakness: CWE-20

V. Comments for CVE-2024-6423

No comments yet

Leave a comment