cveboard RSS feed

CVE-2024-4412

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2024
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 Enterprise Integrator

Vendor
WSO2
Product
WSO2 Enterprise Integrator
Platforms
Unknown
Default status
unaffected
WSO2 Enterprise Integrator · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom6.6.0UnavailableNone listed
6.6.0affectedcustom6.6.0.205UnavailableNone listed

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.1.0UnavailableNone listed
3.1.0affectedcustom3.1.0.276UnavailableNone listed
3.2.0affectedcustom3.2.0.366UnavailableNone listed
3.2.1affectedcustom3.2.1.18UnavailableNone listed
4.0.0affectedcustom4.0.0.307UnavailableNone listed
4.1.0affectedcustom4.1.0.169UnavailableNone listed
4.2.0affectedcustom4.2.0.108UnavailableNone listed
4.3.0affectedcustom4.3.0.20UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.346UnavailableNone listed

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.297UnavailableNone listed
5.11.0affectedcustom5.11.0.337UnavailableNone listed
6.0.0affectedcustom6.0.0.189UnavailableNone listed
6.1.0affectedcustom6.1.0.149UnavailableNone listed
7.0.0affectedcustom7.0.0.15UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.293UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.326UnavailableNone listed

WSO2 Carbon Identity User Store Configuration UI

Vendor
WSO2
Product
WSO2 Carbon Identity User Store Configuration UI
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui
WSO2 Carbon Identity User Store Configuration UI · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.14.127affectedcustom5.14.127.8UnavailableNone listed
5.17.5affectedcustom5.17.5.266UnavailableNone listed
5.17.118affectedcustom5.17.118.6UnavailableNone listed
5.18.187affectedcustom5.18.187.253UnavailableNone listed
5.18.248affectedcustom5.18.248.20UnavailableNone listed
5.23.8affectedcustom5.23.8.178UnavailableNone listed
5.24.8affectedcustom5.24.8.9UnavailableNone listed
5.25.92affectedcustom5.25.92.81UnavailableNone listed
5.25.705affectedcustom5.25.705.8UnavailableNone listed
7.0.78affectedcustom7.0.78.12UnavailableNone listed

WSO2 Carbon Identity User Store Configuration

Vendor
WSO2
Product
WSO2 Carbon Identity User Store Configuration
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.user.store.configuration
WSO2 Carbon Identity User Store Configuration · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.14.127affectedcustom5.14.127.8UnavailableNone listed
5.17.5affectedcustom5.17.5.266UnavailableNone listed
5.17.118affectedcustom5.17.118.6UnavailableNone listed
5.18.187affectedcustom5.18.187.253UnavailableNone listed
5.18.248affectedcustom5.18.248.20UnavailableNone listed
5.23.8affectedcustom5.23.8.178UnavailableNone listed
5.24.8affectedcustom5.24.8.9UnavailableNone listed
5.25.92affectedcustom5.25.92.81UnavailableNone listed
5.25.705affectedcustom5.25.705.8UnavailableNone listed
7.0.78affectedcustom7.0.78.12UnavailableNone listed

WSO2 Carbon Identity Recovery Management

Vendor
WSO2
Product
WSO2 Carbon Identity Recovery Management
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery
WSO2 Carbon Identity Recovery Management · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.4.72affectedcustom1.4.72.66UnavailableNone listed
1.4.100affectedcustom1.4.100.6UnavailableNone listed
1.7.2affectedcustom1.7.2.2UnavailableNone listed
1.8.107affectedcustom1.8.107.1UnavailableNone listed

WSO2 Carbon Identity Application Authentication Framework

Vendor
WSO2
Product
WSO2 Carbon Identity Application Authentication Framework
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework
WSO2 Carbon Identity Application Authentication Framework · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.18.248affectedcustom5.18.248.20UnavailableNone listed
5.24.8affectedcustom5.24.8.9UnavailableNone listed
5.25.705affectedcustom5.25.705.8UnavailableNone listed

WSO2 Carbon Identity User Store

Vendor
WSO2
Product
WSO2 Carbon Identity User Store
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.api.server.userstore.v1
WSO2 Carbon Identity User Store · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.0.190affectedcustom1.0.190.14UnavailableNone listed
1.2.3affectedcustom1.2.3.4UnavailableNone listed
1.2.23affectedcustom1.2.23.4UnavailableNone listed