CVE-2024-6423
Medium
Description
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
SeverityMedium
CVSS4.0
Exploit probability—
ProductWSO2 API Manager
PublishedOct 21, 2026
First seenOct 21, 2026
Weakness typeCWE-20Improper input validation
How to fix
Update
- WSO2 WSO2 API Manager3.1.0.313, 3.2.0.406, 3.2.1.30, 4.0.0.324, 4.1.0.185, 4.2.0.124, 4.3.0.36, 4.4.0.2 or later
- WSO2 WSO2 Open Banking AM2.0.0.363 or later
- WSO2 WSO2 Identity Server5.10.0.337, 5.11.0.384, 6.0.0.213, 6.1.0.211, 7.0.0.50 or later
- WSO2 WSO2 Identity Server as Key Manager5.10.0.329 or later
- WSO2 WSO2 Open Banking IAM2.0.0.381 or later
- WSO2 WSO2 Carbon Identity Application6.3.0.18, 6.3.11.23, 6.3.58.1, 6.5.0.5, 6.6.0.1, 6.7.8.4, 6.7.32.1 or later
- WSO2 WSO2 Carbon Identity Core5.17.5.286, 5.17.118.11, 5.18.187.263, 5.18.248.23, 5.23.8.189, 5.24.8.12, 5.25.92.91, 5.25.92.118, 5.25.705.11, 5.25.713.2, 7.0.78.27 or later
- WSO2 WSO2 Carbon Identity Oauth6.4.2.142, 6.4.176.20, 6.4.180.8, 6.8.0.40, 6.9.6.16, 6.11.21.44, 6.13.16.6, 6.13.19.2, 7.0.26.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WSO2 WSO2 API Manager | 3.1.0 ≤ v < 3.1.0.313, 3.2.0 ≤ v < 3.2.0.406, 3.2.1 ≤ v < 3.2.1.30, 4.0.0 ≤ v < 4.0.0.324, 4.1.0 ≤ v < 4.1.0.185, 4.2.0 ≤ v < 4.2.0.124, 4.3.0 ≤ v < 4.3.0.36, 4.4.0 ≤ v < 4.4.0.2 | 3.1.0.313, 3.2.0.406, 3.2.1.30, 4.0.0.324, 4.1.0.185, 4.2.0.124, 4.3.0.36, 4.4.0.2 |
| WSO2 WSO2 Open Banking AM | 2.0.0 ≤ v < 2.0.0.363 | 2.0.0.363 |
| WSO2 WSO2 Identity Server | 5.10.0 ≤ v < 5.10.0.337, 5.11.0 ≤ v < 5.11.0.384, 6.0.0 ≤ v < 6.0.0.213, 6.1.0 ≤ v < 6.1.0.211, 7.0.0 ≤ v < 7.0.0.50 | 5.10.0.337, 5.11.0.384, 6.0.0.213, 6.1.0.211, 7.0.0.50 |
| WSO2 WSO2 Identity Server as Key Manager | 5.10.0 ≤ v < 5.10.0.329 | 5.10.0.329 |
| WSO2 WSO2 Open Banking IAM | 2.0.0 ≤ v < 2.0.0.381 | 2.0.0.381 |
| WSO2 WSO2 Carbon Identity Application | 6.3.0 ≤ v < 6.3.0.18, 6.3.11 ≤ v < 6.3.11.23, 6.3.58 ≤ v < 6.3.58.1, 6.5.0 ≤ v < 6.5.0.5, 6.6.0 ≤ v < 6.6.0.1, 6.7.8 ≤ v < 6.7.8.4, 6.7.32 ≤ v < 6.7.32.1 | 6.3.0.18, 6.3.11.23, 6.3.58.1, 6.5.0.5, 6.6.0.1, 6.7.8.4, 6.7.32.1 |
| WSO2 WSO2 Carbon Identity Core | 5.17.5 ≤ v < 5.17.5.286, 5.17.118 ≤ v < 5.17.118.11, 5.18.187 ≤ v < 5.18.187.263, 5.18.248 ≤ v < 5.18.248.23, 5.23.8 ≤ v < 5.23.8.189, 5.24.8 ≤ v < 5.24.8.12, 5.25.92 ≤ v < 5.25.92.91, 5.25.92 ≤ v < 5.25.92.118, 5.25.705 ≤ v < 5.25.705.11, 5.25.713 ≤ v < 5.25.713.2, 7.0.78 ≤ v < 7.0.78.27 | 5.17.5.286, 5.17.118.11, 5.18.187.263, 5.18.248.23, 5.23.8.189, 5.24.8.12, 5.25.92.91, 5.25.92.118, 5.25.705.11, 5.25.713.2, 7.0.78.27 |
| WSO2 WSO2 Carbon Identity Oauth | 6.4.2 ≤ v < 6.4.2.142, 6.4.176 ≤ v < 6.4.176.20, 6.4.180 ≤ v < 6.4.180.8, 6.8.0 ≤ v < 6.8.0.40, 6.9.6 ≤ v < 6.9.6.16, 6.11.21 ≤ v < 6.11.21.44, 6.13.16 ≤ v < 6.13.16.6, 6.13.19 ≤ v < 6.13.19.2, 7.0.26 ≤ v < 7.0.26.18 | 6.4.2.142, 6.4.176.20, 6.4.180.8, 6.8.0.40, 6.9.6.16, 6.11.21.44, 6.13.16.6, 6.13.19.2, 7.0.26.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.