cveboard RSS feed

CVE-2024-6423

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2024
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

WSO2 API Manager

Vendor
WSO2
Product
WSO2 API Manager
Platforms
Unknown
Default status
unaffected
WSO2 API Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom3.1.0UnavailableNone listed
3.1.0affectedcustom3.1.0.313UnavailableNone listed
3.2.0affectedcustom3.2.0.406UnavailableNone listed
3.2.1affectedcustom3.2.1.30UnavailableNone listed
4.0.0affectedcustom4.0.0.324UnavailableNone listed
4.1.0affectedcustom4.1.0.185UnavailableNone listed
4.2.0affectedcustom4.2.0.124UnavailableNone listed
4.3.0affectedcustom4.3.0.36UnavailableNone listed
4.4.0affectedcustom4.4.0.2UnavailableNone listed

WSO2 Open Banking AM

Vendor
WSO2
Product
WSO2 Open Banking AM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking AM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.363UnavailableNone listed

WSO2 Identity Server

Vendor
WSO2
Product
WSO2 Identity Server
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.337UnavailableNone listed
5.11.0affectedcustom5.11.0.384UnavailableNone listed
6.0.0affectedcustom6.0.0.213UnavailableNone listed
6.1.0affectedcustom6.1.0.211UnavailableNone listed
7.0.0affectedcustom7.0.0.50UnavailableNone listed

WSO2 Identity Server as Key Manager

Vendor
WSO2
Product
WSO2 Identity Server as Key Manager
Platforms
Unknown
Default status
unaffected
WSO2 Identity Server as Key Manager · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom5.10.0UnavailableNone listed
5.10.0affectedcustom5.10.0.329UnavailableNone listed

WSO2 Open Banking IAM

Vendor
WSO2
Product
WSO2 Open Banking IAM
Platforms
Unknown
Default status
unaffected
WSO2 Open Banking IAM · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0unknowncustom2.0.0UnavailableNone listed
2.0.0affectedcustom2.0.0.381UnavailableNone listed

WSO2 Carbon Identity Application

Vendor
WSO2
Product
WSO2 Carbon Identity Application
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.application.authenticator.basicauth
WSO2 Carbon Identity Application · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.3.0affectedcustom6.3.0.18UnavailableNone listed
6.3.11affectedcustom6.3.11.23UnavailableNone listed
6.3.58affectedcustom6.3.58.1UnavailableNone listed
6.5.0affectedcustom6.5.0.5UnavailableNone listed
6.6.0affectedcustom6.6.0.1UnavailableNone listed
6.7.8affectedcustom6.7.8.4UnavailableNone listed
6.7.32affectedcustom6.7.32.1UnavailableNone listed
xunaffectedcustomUnavailable*None listed

WSO2 Carbon Identity Core

Vendor
WSO2
Product
WSO2 Carbon Identity Core
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.core
WSO2 Carbon Identity Core · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
5.17.5affectedcustom5.17.5.286UnavailableNone listed
5.17.118affectedcustom5.17.118.11UnavailableNone listed
5.18.187affectedcustom5.18.187.263UnavailableNone listed
5.18.248affectedcustom5.18.248.23UnavailableNone listed
5.23.8affectedcustom5.23.8.189UnavailableNone listed
5.24.8affectedcustom5.24.8.12UnavailableNone listed
5.25.92affectedcustom5.25.92.91UnavailableNone listed
5.25.92affectedcustom5.25.92.118UnavailableNone listed
5.25.705affectedcustom5.25.705.11UnavailableNone listed
5.25.713affectedcustom5.25.713.2UnavailableNone listed
7.0.78affectedcustom7.0.78.27UnavailableNone listed
xunaffectedcustomUnavailable*None listed

WSO2 Carbon Identity Oauth

Vendor
WSO2
Product
WSO2 Carbon Identity Oauth
Platforms
Unknown
Default status
unknown
Package
org.wso2.carbon.identity.oauth.common
WSO2 Carbon Identity Oauth · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
6.4.2affectedcustom6.4.2.142UnavailableNone listed
6.4.176affectedcustom6.4.176.20UnavailableNone listed
6.4.180affectedcustom6.4.180.8UnavailableNone listed
6.8.0affectedcustom6.8.0.40UnavailableNone listed
6.9.6affectedcustom6.9.6.16UnavailableNone listed
6.11.21affectedcustom6.11.21.44UnavailableNone listed
6.13.16affectedcustom6.13.16.6UnavailableNone listed
6.13.19affectedcustom6.13.19.2UnavailableNone listed
7.0.26affectedcustom7.0.26.18UnavailableNone listed