4.0
MediumCVSS 3.1 · from WSO2
CVE-2024-6423
Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
WSO2 API Manager · Improper input validation · CWE-20AffectedWSO2 API Manager, WSO2 Open Banking AM, WSO2 Identity Server and 5 more
FixUpdate to 3.1.0.313, 3.2.0.406, 3.2.1.30, 4.0.0.324 or newer
PublishedOct 21, 13:56 · WSO2
ScoredOct 21 · 4.0 · WSO2
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data. CVSS impact.
Description
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
From WSO2
Affected and fixed versions
ProductAffectedFixed inWSO2 API Manager3.1.0 – before 3.1.0.3133.1.0.313WSO2 API Manager3.2.0 – before 3.2.0.4063.2.0.406WSO2 API Manager3.2.1 – before 3.2.1.303.2.1.30WSO2 API Manager4.0.0 – before 4.0.0.3244.0.0.324WSO2 API Manager4.1.0 – before 4.1.0.1854.1.0.185WSO2 API Manager4.2.0 – before 4.2.0.1244.2.0.124WSO2 API Manager4.3.0 – before 4.3.0.364.3.0.36WSO2 API Manager4.4.0 – before 4.4.0.24.4.0.2WSO2 Open Banking AM2.0.0 – before 2.0.0.3632.0.0.363WSO2 Identity Server5.10.0 – before 5.10.0.3375.10.0.337WSO2 Identity Server5.11.0 – before 5.11.0.3845.11.0.384WSO2 Identity Server6.0.0 – before 6.0.0.2136.0.0.213WSO2 Identity Server6.1.0 – before 6.1.0.2116.1.0.211WSO2 Identity Server7.0.0 – before 7.0.0.507.0.0.50WSO2 Identity Server as Key Manager5.10.0 – before 5.10.0.3295.10.0.329WSO2 Open Banking IAM2.0.0 – before 2.0.0.3812.0.0.381org.wso2.carbon.identity.application.authenticator.basicauth6.3.0 – before 6.3.0.186.3.0.18org.wso2.carbon.identity.application.authenticator.basicauth6.3.11 – before 6.3.11.236.3.11.23org.wso2.carbon.identity.application.authenticator.basicauth6.3.58 – before 6.3.58.16.3.58.1org.wso2.carbon.identity.application.authenticator.basicauth6.5.0 – before 6.5.0.56.5.0.5
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known