Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-4989

Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 4.1.0unknown
  • 4.1.0 to < 4.1.0.153affected
  • 4.2.0 to < 4.2.0.105affected
  • 4.3.0 to < 4.3.0.20affected

References