Skip to content
CVE PROGRAM SOURCE RECORD4.0 Medium

CVE-2024-6423

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WSO2

Description

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WSO2 WSO2 API Manager

Default version status: unaffected

  • 0 to < 3.1.0unknown
  • 3.1.0 to < 3.1.0.313affected
  • 3.2.0 to < 3.2.0.406affected
  • 3.2.1 to < 3.2.1.30affected
  • 4.0.0 to < 4.0.0.324affected
  • 4.1.0 to < 4.1.0.185affected
  • 4.2.0 to < 4.2.0.124affected
  • 4.3.0 to < 4.3.0.36affected
  • 4.4.0 to < 4.4.0.2affected

WSO2 WSO2 Open Banking AM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.363affected

WSO2 WSO2 Identity Server

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.337affected
  • 5.11.0 to < 5.11.0.384affected
  • 6.0.0 to < 6.0.0.213affected
  • 6.1.0 to < 6.1.0.211affected
  • 7.0.0 to < 7.0.0.50affected

WSO2 WSO2 Identity Server as Key Manager

Default version status: unaffected

  • 0 to < 5.10.0unknown
  • 5.10.0 to < 5.10.0.329affected

WSO2 WSO2 Open Banking IAM

Default version status: unaffected

  • 0 to < 2.0.0unknown
  • 2.0.0 to < 2.0.0.381affected

WSO2 WSO2 Carbon Identity Application

Default version status: unknown

  • 6.3.0 to < 6.3.0.18affected
  • 6.3.11 to < 6.3.11.23affected
  • 6.3.58 to < 6.3.58.1affected
  • 6.5.0 to < 6.5.0.5affected
  • 6.6.0 to < 6.6.0.1affected
  • 6.7.8 to < 6.7.8.4affected
  • 6.7.32 to < 6.7.32.1affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Identity Core

Default version status: unknown

  • 5.17.5 to < 5.17.5.286affected
  • 5.17.118 to < 5.17.118.11affected
  • 5.18.187 to < 5.18.187.263affected
  • 5.18.248 to < 5.18.248.23affected
  • 5.23.8 to < 5.23.8.189affected
  • 5.24.8 to < 5.24.8.12affected
  • 5.25.92 to < 5.25.92.91affected
  • 5.25.92 to < 5.25.92.118affected
  • 5.25.705 to < 5.25.705.11affected
  • 5.25.713 to < 5.25.713.2affected
  • 7.0.78 to < 7.0.78.27affected
  • x to ≤ *unaffected

WSO2 WSO2 Carbon Identity Oauth

Default version status: unknown

  • 6.4.2 to < 6.4.2.142affected
  • 6.4.176 to < 6.4.176.20affected
  • 6.4.180 to < 6.4.180.8affected
  • 6.8.0 to < 6.8.0.40affected
  • 6.9.6 to < 6.9.6.16affected
  • 6.11.21 to < 6.11.21.44affected
  • 6.13.16 to < 6.13.16.6affected
  • 6.13.19 to < 6.13.19.2affected
  • 7.0.26 to < 7.0.26.18affected

References