Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2024-4412

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 Enterprise Integrator

Default version status: unaffected

  • 0 to < 6.6.0unknown
  • 6.6.0 to < 6.6.0.205affected

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.276affected
  • 3.2.0 to < 3.2.0.366affected
  • 3.2.1 to < 3.2.1.18affected
  • 4.0.0 to < 4.0.0.307affected
  • 4.1.0 to < 4.1.0.169affected
  • 4.2.0 to < 4.2.0.108affected
  • 4.3.0 to < 4.3.0.20affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.346affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.297affected
  • 5.11.0 to < 5.11.0.337affected
  • 6.0.0 to < 6.0.0.189affected
  • 6.1.0 to < 6.1.0.149affected
  • 7.0.0 to < 7.0.0.15affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.293affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.326affected

WSO2 WSO2 Carbon Identity User Store Configuration UI

Default version status: unknown

  • 5.14.127 to < 5.14.127.8affected
  • 5.17.5 to < 5.17.5.266affected
  • 5.17.118 to < 5.17.118.6affected
  • 5.18.187 to < 5.18.187.253affected
  • 5.18.248 to < 5.18.248.20affected
  • 5.23.8 to < 5.23.8.178affected
  • 5.24.8 to < 5.24.8.9affected
  • 5.25.92 to < 5.25.92.81affected
  • 5.25.705 to < 5.25.705.8affected
  • 7.0.78 to < 7.0.78.12affected

WSO2 WSO2 Carbon Identity User Store Configuration

Default version status: unknown

  • 5.14.127 to < 5.14.127.8affected
  • 5.17.5 to < 5.17.5.266affected
  • 5.17.118 to < 5.17.118.6affected
  • 5.18.187 to < 5.18.187.253affected
  • 5.18.248 to < 5.18.248.20affected
  • 5.23.8 to < 5.23.8.178affected
  • 5.24.8 to < 5.24.8.9affected
  • 5.25.92 to < 5.25.92.81affected
  • 5.25.705 to < 5.25.705.8affected
  • 7.0.78 to < 7.0.78.12affected

WSO2 WSO2 Carbon Identity Recovery Management

Default version status: unknown

  • 1.4.72 to < 1.4.72.66affected
  • 1.4.100 to < 1.4.100.6affected
  • 1.7.2 to < 1.7.2.2affected
  • 1.8.107 to < 1.8.107.1affected

WSO2 WSO2 Carbon Identity Application Authentication Framework

Default version status: unknown

  • 5.18.248 to < 5.18.248.20affected
  • 5.24.8 to < 5.24.8.9affected
  • 5.25.705 to < 5.25.705.8affected

WSO2 WSO2 Carbon Identity User Store

Default version status: unknown

  • 1.0.190 to < 1.0.190.14affected
  • 1.2.3 to < 1.2.3.4affected
  • 1.2.23 to < 1.2.23.4affected

References