CVE-2024-12139
Description
The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.
How to fix
- WSO2 WSO2 API Manager3.2.1.49, 4.1.0.210, 4.2.0.148 or later
- WSO2 WSO2 Identity Server5.10.0.346, 5.11.0.385, 6.0.0.229 or later
- WSO2 WSO2 Identity Server as Key Manager5.10.0.339 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 API Manager | 3.2.1 ≤ v < 3.2.1.49, 4.1.0 ≤ v < 4.1.0.210, 4.2.0 ≤ v < 4.2.0.148 | 3.2.1.49, 4.1.0.210, 4.2.0.148 |
| WSO2 WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.346, 5.11.0 ≤ v < 5.11.0.385, 6.0.0 ≤ v < 6.0.0.229 | 5.10.0.346, 5.11.0.385, 6.0.0.229 |
| WSO2 WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.339 | 5.10.0.339 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.