{"id":"CVE-2024-6423","state":"PUBLISHED","title":"Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage","description":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.","publishedAt":"2026-10-21T13:56:26.552Z","updatedAt":"2026-10-30T15:11:58.008Z","severity":{"score":4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","source":"WSO2"},"assigner":"WSO2","products":["WSO2 WSO2 API Manager","WSO2 WSO2 Open Banking AM","WSO2 WSO2 Identity Server","WSO2 WSO2 Identity Server as Key Manager","WSO2 WSO2 Open Banking IAM","WSO2 WSO2 Carbon Identity Application","WSO2 WSO2 Carbon Identity Core","WSO2 WSO2 Carbon Identity Oauth"],"affected":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.1.0","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.313","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.406","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.30","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.324","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.185","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.124","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.36","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"4.4.0.2","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.363","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.10.0","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.337","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.384","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.213","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.211","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.50","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.10.0","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.329","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.381","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Carbon Identity Application","packageName":"org.wso2.carbon.identity.application.authenticator.basicauth","defaultStatus":"unknown","versions":[{"version":"6.3.0","status":"affected","lessThan":"6.3.0.18","versionType":"custom"},{"version":"6.3.11","status":"affected","lessThan":"6.3.11.23","versionType":"custom"},{"version":"6.3.58","status":"affected","lessThan":"6.3.58.1","versionType":"custom"},{"version":"6.5.0","status":"affected","lessThan":"6.5.0.5","versionType":"custom"},{"version":"6.6.0","status":"affected","lessThan":"6.6.0.1","versionType":"custom"},{"version":"6.7.8","status":"affected","lessThan":"6.7.8.4","versionType":"custom"},{"version":"6.7.32","status":"affected","lessThan":"6.7.32.1","versionType":"custom"},{"version":"x","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Carbon Identity Core","packageName":"org.wso2.carbon.identity.core","defaultStatus":"unknown","versions":[{"version":"5.17.5","status":"affected","lessThan":"5.17.5.286","versionType":"custom"},{"version":"5.17.118","status":"affected","lessThan":"5.17.118.11","versionType":"custom"},{"version":"5.18.187","status":"affected","lessThan":"5.18.187.263","versionType":"custom"},{"version":"5.18.248","status":"affected","lessThan":"5.18.248.23","versionType":"custom"},{"version":"5.23.8","status":"affected","lessThan":"5.23.8.189","versionType":"custom"},{"version":"5.24.8","status":"affected","lessThan":"5.24.8.12","versionType":"custom"},{"version":"5.25.92","status":"affected","lessThan":"5.25.92.91","versionType":"custom"},{"version":"5.25.92","status":"affected","lessThan":"5.25.92.118","versionType":"custom"},{"version":"5.25.705","status":"affected","lessThan":"5.25.705.11","versionType":"custom"},{"version":"5.25.713","status":"affected","lessThan":"5.25.713.2","versionType":"custom"},{"version":"7.0.78","status":"affected","lessThan":"7.0.78.27","versionType":"custom"},{"version":"x","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","packageName":"org.wso2.carbon.identity.oauth.common","defaultStatus":"unknown","versions":[{"version":"6.4.2","status":"affected","lessThan":"6.4.2.142","versionType":"custom"},{"version":"6.4.176","status":"affected","lessThan":"6.4.176.20","versionType":"custom"},{"version":"6.4.180","status":"affected","lessThan":"6.4.180.8","versionType":"custom"},{"version":"6.8.0","status":"affected","lessThan":"6.8.0.40","versionType":"custom"},{"version":"6.9.6","status":"affected","lessThan":"6.9.6.16","versionType":"custom"},{"version":"6.11.21","status":"affected","lessThan":"6.11.21.44","versionType":"custom"},{"version":"6.13.16","status":"affected","lessThan":"6.13.16.6","versionType":"custom"},{"version":"6.13.19","status":"affected","lessThan":"6.13.19.2","versionType":"custom"},{"version":"7.0.26","status":"affected","lessThan":"7.0.26.18","versionType":"custom"}]}],"references":["https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/"],"weaknesses":["CWE-20"],"ingestedAt":"2026-10-30T15:18:06.520Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/6xxx/CVE-2024-6423.json","commit":"70fdf27998a84c5869ef58058ee273012c4794a3","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-6423","state":"PUBLISHED","datePublished":"2026-10-21T13:56:26.552Z","dateUpdated":"2026-10-30T15:11:58.008Z","assignerShortName":"WSO2","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateReserved":"2024-07-01T08:23:45.912Z"},"containers":{"cna":{"title":"Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage","descriptions":[{"lang":"en","value":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."}],"affected":[{"vendor":"WSO2","product":"WSO2 API Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"3.1.0","versionType":"custom"},{"version":"3.1.0","status":"affected","lessThan":"3.1.0.313","versionType":"custom"},{"version":"3.2.0","status":"affected","lessThan":"3.2.0.406","versionType":"custom"},{"version":"3.2.1","status":"affected","lessThan":"3.2.1.30","versionType":"custom"},{"version":"4.0.0","status":"affected","lessThan":"4.0.0.324","versionType":"custom"},{"version":"4.1.0","status":"affected","lessThan":"4.1.0.185","versionType":"custom"},{"version":"4.2.0","status":"affected","lessThan":"4.2.0.124","versionType":"custom"},{"version":"4.3.0","status":"affected","lessThan":"4.3.0.36","versionType":"custom"},{"version":"4.4.0","status":"affected","lessThan":"4.4.0.2","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking AM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.363","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.10.0","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.337","versionType":"custom"},{"version":"5.11.0","status":"affected","lessThan":"5.11.0.384","versionType":"custom"},{"version":"6.0.0","status":"affected","lessThan":"6.0.0.213","versionType":"custom"},{"version":"6.1.0","status":"affected","lessThan":"6.1.0.211","versionType":"custom"},{"version":"7.0.0","status":"affected","lessThan":"7.0.0.50","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"5.10.0","versionType":"custom"},{"version":"5.10.0","status":"affected","lessThan":"5.10.0.329","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","defaultStatus":"unaffected","versions":[{"version":"0","status":"unknown","lessThan":"2.0.0","versionType":"custom"},{"version":"2.0.0","status":"affected","lessThan":"2.0.0.381","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Carbon Identity Application","packageName":"org.wso2.carbon.identity.application.authenticator.basicauth","defaultStatus":"unknown","versions":[{"version":"6.3.0","status":"affected","lessThan":"6.3.0.18","versionType":"custom"},{"version":"6.3.11","status":"affected","lessThan":"6.3.11.23","versionType":"custom"},{"version":"6.3.58","status":"affected","lessThan":"6.3.58.1","versionType":"custom"},{"version":"6.5.0","status":"affected","lessThan":"6.5.0.5","versionType":"custom"},{"version":"6.6.0","status":"affected","lessThan":"6.6.0.1","versionType":"custom"},{"version":"6.7.8","status":"affected","lessThan":"6.7.8.4","versionType":"custom"},{"version":"6.7.32","status":"affected","lessThan":"6.7.32.1","versionType":"custom"},{"version":"x","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Carbon Identity Core","packageName":"org.wso2.carbon.identity.core","defaultStatus":"unknown","versions":[{"version":"5.17.5","status":"affected","lessThan":"5.17.5.286","versionType":"custom"},{"version":"5.17.118","status":"affected","lessThan":"5.17.118.11","versionType":"custom"},{"version":"5.18.187","status":"affected","lessThan":"5.18.187.263","versionType":"custom"},{"version":"5.18.248","status":"affected","lessThan":"5.18.248.23","versionType":"custom"},{"version":"5.23.8","status":"affected","lessThan":"5.23.8.189","versionType":"custom"},{"version":"5.24.8","status":"affected","lessThan":"5.24.8.12","versionType":"custom"},{"version":"5.25.92","status":"affected","lessThan":"5.25.92.91","versionType":"custom"},{"version":"5.25.92","status":"affected","lessThan":"5.25.92.118","versionType":"custom"},{"version":"5.25.705","status":"affected","lessThan":"5.25.705.11","versionType":"custom"},{"version":"5.25.713","status":"affected","lessThan":"5.25.713.2","versionType":"custom"},{"version":"7.0.78","status":"affected","lessThan":"7.0.78.27","versionType":"custom"},{"version":"x","status":"unaffected","lessThanOrEqual":"*","versionType":"custom"}]},{"vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","packageName":"org.wso2.carbon.identity.oauth.common","defaultStatus":"unknown","versions":[{"version":"6.4.2","status":"affected","lessThan":"6.4.2.142","versionType":"custom"},{"version":"6.4.176","status":"affected","lessThan":"6.4.176.20","versionType":"custom"},{"version":"6.4.180","status":"affected","lessThan":"6.4.180.8","versionType":"custom"},{"version":"6.8.0","status":"affected","lessThan":"6.8.0.40","versionType":"custom"},{"version":"6.9.6","status":"affected","lessThan":"6.9.6.16","versionType":"custom"},{"version":"6.11.21","status":"affected","lessThan":"6.11.21.44","versionType":"custom"},{"version":"6.13.16","status":"affected","lessThan":"6.13.16.6","versionType":"custom"},{"version":"6.13.19","status":"affected","lessThan":"6.13.19.2","versionType":"custom"},{"version":"7.0.26","status":"affected","lessThan":"7.0.26.18","versionType":"custom"}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4,"vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","lang":"en","description":"CWE-20: Improper Input Validation","type":"CWE"}]}],"providerMetadata":{"shortName":"WSO2","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","dateUpdated":"2026-10-21T13:59:54.562Z"},"impacts":[{"capecId":"CAPEC-246","descriptions":[{"lang":"en","value":"CAPEC-246 CAPEC-246: Data Transmission"}]}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1.0","versionEndExcluding":"3.1.0.313"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.0","versionEndExcluding":"3.2.0.406"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.1","versionEndExcluding":"3.2.1.30"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.0.324"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.0.185"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.0.124"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.0.36"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.0","versionEndExcluding":"4.4.0.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.0.363"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.0","versionEndExcluding":"5.10.0.337"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.0","versionEndExcluding":"5.11.0.384"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.0.213"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.0","versionEndExcluding":"6.1.0.211"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.0.50"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.0","versionEndExcluding":"5.10.0.329"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.0.381"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.0","versionEndExcluding":"6.3.0.18"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.11","versionEndExcluding":"6.3.11.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.58","versionEndExcluding":"6.3.58.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.0","versionEndExcluding":"6.5.0.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.0","versionEndExcluding":"6.6.0.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.8","versionEndExcluding":"6.7.8.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.32","versionEndExcluding":"6.7.32.1"},{"vulnerable":false,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"x","versionEndIncluding":"*"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.5","versionEndExcluding":"5.17.5.286"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.118","versionEndExcluding":"5.17.118.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.187","versionEndExcluding":"5.18.187.263"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.248","versionEndExcluding":"5.18.248.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.23.8","versionEndExcluding":"5.23.8.189"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.24.8","versionEndExcluding":"5.24.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.92","versionEndExcluding":"5.25.92.91"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.92","versionEndExcluding":"5.25.92.118"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.705","versionEndExcluding":"5.25.705.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.713","versionEndExcluding":"5.25.713.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.78","versionEndExcluding":"7.0.78.27"},{"vulnerable":false,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"x","versionEndIncluding":"*"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.2","versionEndExcluding":"6.4.2.142"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.176","versionEndExcluding":"6.4.176.20"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.180","versionEndExcluding":"6.4.180.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8.0","versionEndExcluding":"6.8.0.40"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9.6","versionEndExcluding":"6.9.6.16"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11.21","versionEndExcluding":"6.11.21.44"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.16","versionEndExcluding":"6.13.16.6"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.19","versionEndExcluding":"6.13.19.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.26","versionEndExcluding":"7.0.26.18"}]}]}],"solutions":[{"lang":"en","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution","supportingMedia":[{"type":"text/html","base64":false,"value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution</span></a> <br>"}]}],"source":{"advisory":"WSO2-2024-3465","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T15:11:01.346786Z","id":"CVE-2024-6423","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-30T15:11:58.008Z"}}]}}}