{"api_version":"1","generated_at":"2026-10-19T21:56:32+00:00","cve":"CVE-2024-4412","urls":{"html":"https://cve.report/CVE-2024-4412","api":"https://cve.report/api/cve/CVE-2024-4412.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-4412","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-4412"},"summary":{"title":"Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations","description":"The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.","state":"PUBLISHED","assigner":"WSO2","published_at":"2026-10-19 17:16:57","updated_at":"2026-10-19 21:06:28"},"problem_types":["CWE-94","CWE-94 CWE-94: Improper Control of Generation of Code ('Code Injection')"],"metrics":[{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"2.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"2.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/wso2/identity-apps/pull/6829","name":"https://github.com/wso2/identity-apps/pull/6829","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/wso2/product-apim/pull/13524","name":"https://github.com/wso2/product-apim/pull/13524","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/wso2-extensions/identity-governance/pull/848","name":"https://github.com/wso2-extensions/identity-governance/pull/848","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/wso2/carbon-identity-framework/pull/5895","name":"https://github.com/wso2/carbon-identity-framework/pull/5895","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4412","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Integrator","version":"unknown 6.6.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Integrator","version":"affected 6.6.0 6.6.0.205 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 3.1.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.1.0 3.1.0.276 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.0 3.2.0.366 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.1 3.2.1.18 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.0.0 4.0.0.307 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.1.0 4.1.0.169 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.108 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.20 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"affected 2.0.0 2.0.0.346 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.10.0 5.10.0.297 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.11.0 5.11.0.337 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.0.0 6.0.0.189 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.1.0 6.1.0.149 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.0.0 7.0.0.15 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.10.0 5.10.0.293 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"affected 2.0.0 2.0.0.326 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.14.127 5.14.127.8 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.17.5 5.17.5.266 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.17.118 5.17.118.6 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.18.187 5.18.187.253 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.18.248 5.18.248.20 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.23.8 5.23.8.178 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.24.8 5.24.8.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.25.92 5.25.92.81 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 5.25.705 5.25.705.8 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration UI","version":"affected 7.0.78 7.0.78.12 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.14.127 5.14.127.8 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.17.5 5.17.5.266 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.17.118 5.17.118.6 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.18.187 5.18.187.253 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.18.248 5.18.248.20 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.23.8 5.23.8.178 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.24.8 5.24.8.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.25.92 5.25.92.81 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 5.25.705 5.25.705.8 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store Configuration","version":"affected 7.0.78 7.0.78.12 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Recovery Management","version":"affected 1.4.72 1.4.72.66 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Recovery Management","version":"affected 1.4.100 1.4.100.6 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Recovery Management","version":"affected 1.7.2 1.7.2.2 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Recovery Management","version":"affected 1.8.107 1.8.107.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application Authentication Framework","version":"affected 5.18.248 5.18.248.20 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application Authentication Framework","version":"affected 5.24.8 5.24.8.9 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application Authentication Framework","version":"affected 5.25.705 5.25.705.8 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store","version":"affected 1.0.190 1.0.190.14 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store","version":"affected 1.2.3 1.2.3.4 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity User Store","version":"affected 1.2.23 1.2.23.4 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.6.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.6.0.205","status":"affected","version":"6.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.276","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.366","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.18","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.307","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.169","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.108","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.20","status":"affected","version":"4.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.346","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.297","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.337","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.189","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.149","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.15","status":"affected","version":"7.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.293","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.326","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui","product":"WSO2 Carbon Identity User Store Configuration UI","vendor":"WSO2","versions":[{"lessThan":"5.14.127.8","status":"affected","version":"5.14.127","versionType":"custom"},{"lessThan":"5.17.5.266","status":"affected","version":"5.17.5","versionType":"custom"},{"lessThan":"5.17.118.6","status":"affected","version":"5.17.118","versionType":"custom"},{"lessThan":"5.18.187.253","status":"affected","version":"5.18.187","versionType":"custom"},{"lessThan":"5.18.248.20","status":"affected","version":"5.18.248","versionType":"custom"},{"lessThan":"5.23.8.178","status":"affected","version":"5.23.8","versionType":"custom"},{"lessThan":"5.24.8.9","status":"affected","version":"5.24.8","versionType":"custom"},{"lessThan":"5.25.92.81","status":"affected","version":"5.25.92","versionType":"custom"},{"lessThan":"5.25.705.8","status":"affected","version":"5.25.705","versionType":"custom"},{"lessThan":"7.0.78.12","status":"affected","version":"7.0.78","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.user.store.configuration","product":"WSO2 Carbon Identity User Store Configuration","vendor":"WSO2","versions":[{"lessThan":"5.14.127.8","status":"affected","version":"5.14.127","versionType":"custom"},{"lessThan":"5.17.5.266","status":"affected","version":"5.17.5","versionType":"custom"},{"lessThan":"5.17.118.6","status":"affected","version":"5.17.118","versionType":"custom"},{"lessThan":"5.18.187.253","status":"affected","version":"5.18.187","versionType":"custom"},{"lessThan":"5.18.248.20","status":"affected","version":"5.18.248","versionType":"custom"},{"lessThan":"5.23.8.178","status":"affected","version":"5.23.8","versionType":"custom"},{"lessThan":"5.24.8.9","status":"affected","version":"5.24.8","versionType":"custom"},{"lessThan":"5.25.92.81","status":"affected","version":"5.25.92","versionType":"custom"},{"lessThan":"5.25.705.8","status":"affected","version":"5.25.705","versionType":"custom"},{"lessThan":"7.0.78.12","status":"affected","version":"7.0.78","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery","product":"WSO2 Carbon Identity Recovery Management","vendor":"WSO2","versions":[{"lessThan":"1.4.72.66","status":"affected","version":"1.4.72","versionType":"custom"},{"lessThan":"1.4.100.6","status":"affected","version":"1.4.100","versionType":"custom"},{"lessThan":"1.7.2.2","status":"affected","version":"1.7.2","versionType":"custom"},{"lessThan":"1.8.107.1","status":"affected","version":"1.8.107","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework","product":"WSO2 Carbon Identity Application Authentication Framework","vendor":"WSO2","versions":[{"lessThan":"5.18.248.20","status":"affected","version":"5.18.248","versionType":"custom"},{"lessThan":"5.24.8.9","status":"affected","version":"5.24.8","versionType":"custom"},{"lessThan":"5.25.705.8","status":"affected","version":"5.25.705","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.api.server.userstore.v1","product":"WSO2 Carbon Identity User Store","vendor":"WSO2","versions":[{"lessThan":"1.0.190.14","status":"affected","version":"1.0.190","versionType":"custom"},{"lessThan":"1.2.3.4","status":"affected","version":"1.2.3","versionType":"custom"},{"lessThan":"1.2.23.4","status":"affected","version":"1.2.23","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.0.205","versionStartIncluding":"6.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.1.0.276","versionStartIncluding":"3.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0.366","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.1.18","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.307","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.169","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.108","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.20","versionStartIncluding":"4.3.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.346","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.297","versionStartIncluding":"5.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.0.337","versionStartIncluding":"5.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0.189","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.0.149","versionStartIncluding":"6.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.0.15","versionStartIncluding":"7.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.293","versionStartIncluding":"5.10.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.326","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.14.127.8","versionStartIncluding":"5.14.127","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.17.5.266","versionStartIncluding":"5.17.5","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.17.118.6","versionStartIncluding":"5.17.118","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.187.253","versionStartIncluding":"5.18.187","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.248.20","versionStartIncluding":"5.18.248","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.23.8.178","versionStartIncluding":"5.23.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.24.8.9","versionStartIncluding":"5.24.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.92.81","versionStartIncluding":"5.25.92","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.705.8","versionStartIncluding":"5.25.705","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.78.12","versionStartIncluding":"7.0.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.14.127.8","versionStartIncluding":"5.14.127","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.17.5.266","versionStartIncluding":"5.17.5","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.17.118.6","versionStartIncluding":"5.17.118","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.187.253","versionStartIncluding":"5.18.187","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.248.20","versionStartIncluding":"5.18.248","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.23.8.178","versionStartIncluding":"5.23.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.24.8.9","versionStartIncluding":"5.24.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.92.81","versionStartIncluding":"5.25.92","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.705.8","versionStartIncluding":"5.25.705","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.78.12","versionStartIncluding":"7.0.78","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*","versionEndExcluding":"1.4.72.66","versionStartIncluding":"1.4.72","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*","versionEndExcluding":"1.4.100.6","versionStartIncluding":"1.4.100","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.2.2","versionStartIncluding":"1.7.2","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*","versionEndExcluding":"1.8.107.1","versionStartIncluding":"1.8.107","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.248.20","versionStartIncluding":"5.18.248","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionEndExcluding":"5.24.8.9","versionStartIncluding":"5.24.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.705.8","versionStartIncluding":"5.25.705","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*","versionEndExcluding":"1.0.190.14","versionStartIncluding":"1.0.190","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.3.4","versionStartIncluding":"1.2.3","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.23.4","versionStartIncluding":"1.2.23","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."}],"value":"The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."}],"impacts":[{"capecId":"CAPEC-22","descriptions":[{"lang":"en","value":"CAPEC-22 CAPEC-22: Injection"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-94","description":"CWE-94: Improper Control of Generation of Code ('Code Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T16:59:05.004Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"},{"tags":["patch"],"url":"https://github.com/wso2-extensions/identity-governance/pull/848"},{"tags":["patch"],"url":"https://github.com/wso2/carbon-identity-framework/pull/5895"},{"tags":["patch"],"url":"https://github.com/wso2/identity-apps/pull/6829"},{"tags":["patch"],"url":"https://github.com/wso2/product-apim/pull/13524"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution</span></a> <br>"}],"value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution"}],"source":{"advisory":"WSO2-2023-3098","discovery":"INTERNAL"},"title":"Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2024-4412","datePublished":"2026-10-19T16:59:05.004Z","dateReserved":"2024-05-02T08:55:58.638Z","dateUpdated":"2026-10-19T16:59:05.004Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 17:16:57","lastModifiedDate":"2026-10-19 21:06:28","problem_types":["CWE-94","CWE-94 CWE-94: Improper Control of Generation of Code ('Code Injection')"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"4412","Ordinal":"1","Title":"Expression Language Injection via User Input in Multiple WSO2 Pr","CVE":"CVE-2024-4412","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"4412","Ordinal":"1","NoteData":"The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.","Type":"Description","Title":"Expression Language Injection via User Input in Multiple WSO2 Pr"}]}}}