{"api_version":"1","generated_at":"2026-10-24T04:19:20+00:00","cve":"CVE-2024-6423","urls":{"html":"https://cve.report/CVE-2024-6423","api":"https://cve.report/api/cve/CVE-2024-6423.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-6423","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-6423"},"summary":{"title":"Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage","description":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.","state":"PUBLISHED","assigner":"WSO2","published_at":"2026-10-21 14:17:05","updated_at":"2026-10-21 18:37:59"},"problem_types":["CWE-20","CWE-20 CWE-20: Improper Input Validation"],"metrics":[{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"4","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","baseScore":4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","data":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6423","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6423","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 3.1.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.1.0 3.1.0.313 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.0 3.2.0.406 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.1 3.2.1.30 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.0.0 4.0.0.324 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.1.0 4.1.0.185 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.124 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.36 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.4.0 4.4.0.2 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking AM","version":"affected 2.0.0 2.0.0.363 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.10.0 5.10.0.337 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 5.11.0 5.11.0.384 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.0.0 6.0.0.213 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 6.1.0 6.1.0.211 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server","version":"affected 7.0.0 7.0.0.50 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"unknown 5.10.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","version":"affected 5.10.0 5.10.0.329 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"unknown 2.0.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Open Banking IAM","version":"affected 2.0.0 2.0.0.381 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"affected 6.3.0 6.3.0.18 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"affected 6.3.11 6.3.11.23 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"affected 6.3.58 6.3.58.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"affected 6.5.0 6.5.0.5 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"affected 6.6.0 6.6.0.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"affected 6.7.8 6.7.8.4 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"affected 6.7.32 6.7.32.1 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Application","version":"unaffected x * custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.17.5 5.17.5.286 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.17.118 5.17.118.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.18.187 5.18.187.263 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.18.248 5.18.248.23 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.23.8 5.23.8.189 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.24.8 5.24.8.12 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.25.92 5.25.92.91 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.25.92 5.25.92.118 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.25.705 5.25.705.11 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 5.25.713 5.25.713.2 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"affected 7.0.78 7.0.78.27 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Core","version":"unaffected x * custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.4.2 6.4.2.142 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.4.176 6.4.176.20 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.4.180 6.4.180.8 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.8.0 6.8.0.40 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.9.6 6.9.6.16 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.11.21 6.11.21.44 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.13.16 6.13.16.6 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 6.13.19 6.13.19.2 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","version":"affected 7.0.26 7.0.26.18 custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.1.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.1.0.313","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.406","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.30","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.324","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.185","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.124","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.36","status":"affected","version":"4.3.0","versionType":"custom"},{"lessThan":"4.4.0.2","status":"affected","version":"4.4.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.363","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.337","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.384","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.213","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.211","status":"affected","version":"6.1.0","versionType":"custom"},{"lessThan":"7.0.0.50","status":"affected","version":"7.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.10.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.10.0.329","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.381","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.application.authenticator.basicauth","product":"WSO2 Carbon Identity Application","vendor":"WSO2","versions":[{"lessThan":"6.3.0.18","status":"affected","version":"6.3.0","versionType":"custom"},{"lessThan":"6.3.11.23","status":"affected","version":"6.3.11","versionType":"custom"},{"lessThan":"6.3.58.1","status":"affected","version":"6.3.58","versionType":"custom"},{"lessThan":"6.5.0.5","status":"affected","version":"6.5.0","versionType":"custom"},{"lessThan":"6.6.0.1","status":"affected","version":"6.6.0","versionType":"custom"},{"lessThan":"6.7.8.4","status":"affected","version":"6.7.8","versionType":"custom"},{"lessThan":"6.7.32.1","status":"affected","version":"6.7.32","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"x","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.core","product":"WSO2 Carbon Identity Core","vendor":"WSO2","versions":[{"lessThan":"5.17.5.286","status":"affected","version":"5.17.5","versionType":"custom"},{"lessThan":"5.17.118.11","status":"affected","version":"5.17.118","versionType":"custom"},{"lessThan":"5.18.187.263","status":"affected","version":"5.18.187","versionType":"custom"},{"lessThan":"5.18.248.23","status":"affected","version":"5.18.248","versionType":"custom"},{"lessThan":"5.23.8.189","status":"affected","version":"5.23.8","versionType":"custom"},{"lessThan":"5.24.8.12","status":"affected","version":"5.24.8","versionType":"custom"},{"lessThan":"5.25.92.91","status":"affected","version":"5.25.92","versionType":"custom"},{"lessThan":"5.25.92.118","status":"affected","version":"5.25.92","versionType":"custom"},{"lessThan":"5.25.705.11","status":"affected","version":"5.25.705","versionType":"custom"},{"lessThan":"5.25.713.2","status":"affected","version":"5.25.713","versionType":"custom"},{"lessThan":"7.0.78.27","status":"affected","version":"7.0.78","versionType":"custom"},{"lessThanOrEqual":"*","status":"unaffected","version":"x","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon.identity.oauth.common","product":"WSO2 Carbon Identity Oauth","vendor":"WSO2","versions":[{"lessThan":"6.4.2.142","status":"affected","version":"6.4.2","versionType":"custom"},{"lessThan":"6.4.176.20","status":"affected","version":"6.4.176","versionType":"custom"},{"lessThan":"6.4.180.8","status":"affected","version":"6.4.180","versionType":"custom"},{"lessThan":"6.8.0.40","status":"affected","version":"6.8.0","versionType":"custom"},{"lessThan":"6.9.6.16","status":"affected","version":"6.9.6","versionType":"custom"},{"lessThan":"6.11.21.44","status":"affected","version":"6.11.21","versionType":"custom"},{"lessThan":"6.13.16.6","status":"affected","version":"6.13.16","versionType":"custom"},{"lessThan":"6.13.19.2","status":"affected","version":"6.13.19","versionType":"custom"},{"lessThan":"7.0.26.18","status":"affected","version":"7.0.26","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.1.0.313","versionStartIncluding":"3.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0.406","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.1.30","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.324","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.185","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.124","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.36","versionStartIncluding":"4.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.4.0.2","versionStartIncluding":"4.4.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.363","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.337","versionStartIncluding":"5.10.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"5.11.0.384","versionStartIncluding":"5.11.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.0.0.213","versionStartIncluding":"6.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.0.211","versionStartIncluding":"6.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.0.50","versionStartIncluding":"7.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.0.329","versionStartIncluding":"5.10.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.0.381","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3.0.18","versionStartIncluding":"6.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3.11.23","versionStartIncluding":"6.3.11","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndExcluding":"6.3.58.1","versionStartIncluding":"6.3.58","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndExcluding":"6.5.0.5","versionStartIncluding":"6.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.0.1","versionStartIncluding":"6.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.8.4","versionStartIncluding":"6.7.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndExcluding":"6.7.32.1","versionStartIncluding":"6.7.32","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"x","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.17.5.286","versionStartIncluding":"5.17.5","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.17.118.11","versionStartIncluding":"5.17.118","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.187.263","versionStartIncluding":"5.18.187","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.18.248.23","versionStartIncluding":"5.18.248","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.23.8.189","versionStartIncluding":"5.23.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.24.8.12","versionStartIncluding":"5.24.8","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.92.91","versionStartIncluding":"5.25.92","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.92.118","versionStartIncluding":"5.25.92","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.705.11","versionStartIncluding":"5.25.705","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"5.25.713.2","versionStartIncluding":"5.25.713","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.78.27","versionStartIncluding":"7.0.78","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionEndIncluding":"*","versionStartIncluding":"x","vulnerable":false}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.2.142","versionStartIncluding":"6.4.2","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.176.20","versionStartIncluding":"6.4.176","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.4.180.8","versionStartIncluding":"6.4.180","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.8.0.40","versionStartIncluding":"6.8.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.9.6.16","versionStartIncluding":"6.9.6","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.11.21.44","versionStartIncluding":"6.11.21","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.16.6","versionStartIncluding":"6.13.16","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"6.13.19.2","versionStartIncluding":"6.13.19","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.26.18","versionStartIncluding":"7.0.26","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."}],"value":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."}],"impacts":[{"capecId":"CAPEC-246","descriptions":[{"lang":"en","value":"CAPEC-246 CAPEC-246: Data Transmission"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20: Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-21T13:59:54.562Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution</span></a> <br>"}],"value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution"}],"source":{"advisory":"WSO2-2024-3465","discovery":"INTERNAL"},"title":"Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2024-6423","datePublished":"2026-10-21T13:56:26.552Z","dateReserved":"2024-07-01T08:23:45.912Z","dateUpdated":"2026-10-21T13:59:54.562Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-21 14:17:05","lastModifiedDate":"2026-10-21 18:37:59","problem_types":["CWE-20","CWE-20 CWE-20: Improper Input Validation"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N","baseScore":4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":0.3,"impactScore":3.6}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"6423","Ordinal":"1","Title":"Sensitive Data Exposure via URL Parameters in Multiple WSO2 Prod","CVE":"CVE-2024-6423","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"6423","Ordinal":"1","NoteData":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.","Type":"Description","Title":"Sensitive Data Exposure via URL Parameters in Multiple WSO2 Prod"}]}}}