Skip to content
CVE PROGRAM SOURCE RECORD4.0 Medium

CVE-2024-10302

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Control Plane

Default version status: unaffected

  • 4.5.0 to < 4.5.0.10affected

WSO2 WSO2 Traffic Manager

Default version status: unaffected

  • 4.5.0 to < 4.5.0.9affected

WSO2 WSO2 Universal Gateway

Default version status: unaffected

  • 4.5.0 to < 4.5.0.9affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.331affected
  • 3.2.0 to < 3.2.0.427affected
  • 3.2.1 to < 3.2.1.39affected
  • 4.0.0 to < 4.0.0.318affected
  • 4.1.0 to < 4.1.0.200affected
  • 4.2.0 to < 4.2.0.138affected
  • 4.3.0 to < 4.3.0.51affected
  • 4.5.0 to < 4.5.0.9affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.400affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.351affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.358affected
  • 5.11.0 to < 5.11.0.379affected

WSO2 WSO2 Carbon Identity Recovery Management

Default version status: unknown

  • 1.4.1 to < 1.4.1.72affected
  • 1.4.72 to < 1.4.72.68affected
  • 1.4.100 to < 1.4.100.8affected
  • 1.4.102 to < 1.4.102.2affected
  • 1.7.2 to < 1.7.2.4affected
  • 1.8.107 to < 1.8.107.2affected
  • 1.8.108 to < 1.8.108.4affected
  • 1.6.380 to ≤ 1.6.*unaffected
  • 1.8.109 to ≤ *unaffected

References