Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
Summary
| CVE | CVE-2024-6541 |
|---|---|
| State | PUBLISHED |
| Assigner | WSO2 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-06 22:16:40 UTC |
| Updated | 2026-10-27 18:10:00 UTC |
| Description | The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products. |
Risk And Classification
Primary CVSS: v3.1 6.8 MEDIUM from ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.003400000 probability, percentile 0.273890000 (date 2026-10-28)
Problem Types: CWE-20 | CWE-20 CWE-20: Improper Input Validation
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ed10eef1-636d-4fbe-9993-6890dfa878f8 | Secondary | 6.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 6.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | WSO2 | WSO2 Micro Integrator | unknown 1.2.0 custom | Not specified |
| CNA | WSO2 | WSO2 Micro Integrator | affected 1.2.0 1.2.0.163 custom | Not specified |
| CNA | WSO2 | WSO2 Micro Integrator | affected 4.1.0 4.1.0.103 custom | Not specified |
| CNA | WSO2 | WSO2 Micro Integrator | affected 4.3.0 4.3.0.7 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Integrator | unknown 6.6.0 custom | Not specified |
| CNA | WSO2 | WSO2 Enterprise Integrator | affected 6.6.0 6.6.0.205 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | unknown 3.2.0 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.0 3.2.0.394 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 3.2.1 3.2.1.21 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.0.0 4.0.0.311 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.1.0 4.1.0.167 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.2.0 4.2.0.110 custom | Not specified |
| CNA | WSO2 | WSO2 API Manager | affected 4.3.0 4.3.0.24 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 2.1.7.wso2v182 2.1.7.wso2v182_93 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 2.1.7.wso2v143 2.1.7.wso2v143_119 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 2.1.7.wso2v183 2.1.7.wso2v183_62 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 2.1.7.wso2v319 2.1.7.wso2v319_7 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 2.1.7.wso2v227 2.1.7.wso2v227_88 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 2.1.7.wso2v271 2.1.7.wso2v271_60 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 4.0.0.wso2v119 4.0.0.wso2v119_3 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 4.0.0.wso2v105 4.0.0.wso2v105_3 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | affected 4.0.0.wso2v20 4.0.0.wso2v20_63 custom | Not specified |
| CNA | WSO2 | WSO2-Synapse | unaffected v4.0.0-wso2v121 v4.0.0-wso2v* custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO... | ed10eef1-636d-4fbe-9993-6890dfa878f8 | security.docs.wso2.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
Solutions
CNA: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution
There are currently no legacy QID mappings associated with this CVE.