Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage
Summary
| CVE | CVE-2024-6423 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-21 14:17:05 UTC |
| Updated | 2026-10-21 18:37:59 UTC |
| Description | The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly. |
Risk And Classification
Primary CVSS: v3.1 4 MEDIUM from ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Problem Types: CWE-20 | CWE-20 CWE-20: Improper Input Validation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | Secondary | 4 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N |
| 3.1 | CNA | CVSS | 4 | MEDIUM | CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
HighPrivileges Required
HighUser Interaction
RequiredScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 API Manager | unknown 3.1.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.1.0 3.1.0.313 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.0 3.2.0.406 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.1 3.2.1.30 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.0.0 4.0.0.324 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.1.0 4.1.0.185 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.2.0 4.2.0.124 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.3.0 4.3.0.36 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.4.0 4.4.0.2 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking AM | affected 2.0.0 2.0.0.363 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.10.0 5.10.0.337 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 5.11.0 5.11.0.384 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.0.0 6.0.0.213 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 6.1.0 6.1.0.211 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server | affected 7.0.0 7.0.0.50 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | unknown 5.10.0 custom | Not specified |
| CNA | WSO2 | WSO2 Identity Server As Key Manager | affected 5.10.0 5.10.0.329 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | unknown 2.0.0 custom | Not specified |
| CNA | WSO2 | WSO2 Open Banking IAM | affected 2.0.0 2.0.0.381 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | affected 6.3.0 6.3.0.18 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | affected 6.3.11 6.3.11.23 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | affected 6.3.58 6.3.58.1 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | affected 6.5.0 6.5.0.5 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | affected 6.6.0 6.6.0.1 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | affected 6.7.8 6.7.8.4 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | affected 6.7.32 6.7.32.1 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Application | unaffected x * custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.17.5 5.17.5.286 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.17.118 5.17.118.11 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.18.187 5.18.187.263 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.18.248 5.18.248.23 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.23.8 5.23.8.189 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.24.8 5.24.8.12 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.25.92 5.25.92.91 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.25.92 5.25.92.118 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.25.705 5.25.705.11 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 5.25.713 5.25.713.2 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | affected 7.0.78 7.0.78.27 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Core | unaffected x * custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.4.2 6.4.2.142 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.4.176 6.4.176.20 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.4.180 6.4.180.8 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.8.0 6.8.0.40 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.9.6 6.9.6.16 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.11.21 6.11.21.44 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.13.16 6.13.16.6 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 6.13.19 6.13.19.2 custom | Not specified |
| CNA | WSO2 | WSO2 Carbon Identity Oauth | affected 7.0.26 7.0.26.18 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution
There are currently no legacy QID mappings associated with this CVE.