{"api_version":"1","generated_at":"2026-11-07T20:44:11+00:00","cve":"CVE-2024-6541","urls":{"html":"https://cve.report/CVE-2024-6541","api":"https://cve.report/api/cve/CVE-2024-6541.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-6541","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-6541"},"summary":{"title":"Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products","description":"The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.","state":"PUBLISHED","assigner":"WSO2","published_at":"2026-08-06 22:16:40","updated_at":"2026-10-27 18:10:00"},"problem_types":["CWE-20","CWE-20 CWE-20: Improper Input Validation"],"metrics":[{"version":"3.1","source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","score":"6.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"6.8","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/","name":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/","refsource":"ed10eef1-636d-4fbe-9993-6890dfa878f8","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6541","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6541","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"WSO2","product":"WSO2 Micro Integrator","version":"unknown 1.2.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Micro Integrator","version":"affected 1.2.0 1.2.0.163 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Micro Integrator","version":"affected 4.1.0 4.1.0.103 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Micro Integrator","version":"affected 4.3.0 4.3.0.7 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Integrator","version":"unknown 6.6.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 Enterprise Integrator","version":"affected 6.6.0 6.6.0.205 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"unknown 3.2.0 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.0 3.2.0.394 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 3.2.1 3.2.1.21 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.0.0 4.0.0.311 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.1.0 4.1.0.167 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.2.0 4.2.0.110 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2 API Manager","version":"affected 4.3.0 4.3.0.24 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 2.1.7.wso2v182 2.1.7.wso2v182_93 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 2.1.7.wso2v143 2.1.7.wso2v143_119 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 2.1.7.wso2v183 2.1.7.wso2v183_62 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 2.1.7.wso2v319 2.1.7.wso2v319_7 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 2.1.7.wso2v227 2.1.7.wso2v227_88 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 2.1.7.wso2v271 2.1.7.wso2v271_60 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 4.0.0.wso2v119 4.0.0.wso2v119_3 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 4.0.0.wso2v105 4.0.0.wso2v105_3 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"affected 4.0.0.wso2v20 4.0.0.wso2v20_63 custom","platforms":[]},{"source":"CNA","vendor":"WSO2","product":"WSO2-Synapse","version":"unaffected v4.0.0-wso2v121 v4.0.0-wso2v* custom","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2024","cve_id":"6541","cve":"CVE-2024-6541","epss":"0.003400000","percentile":"0.273890000","score_date":"2026-10-28","updated_at":"2026-10-29 00:09:15"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2024-6541","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-07T17:45:31.638289Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-07T17:45:43.395Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"WSO2 Micro Integrator","vendor":"WSO2","versions":[{"lessThan":"1.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"1.2.0.163","status":"affected","version":"1.2.0","versionType":"custom"},{"lessThan":"4.1.0.103","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.3.0.7","status":"affected","version":"4.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.6.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.6.0.205","status":"affected","version":"6.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.2.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.2.0.394","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.21","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.311","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.167","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.110","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.24","status":"affected","version":"4.3.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.apache.synapse:synapse-core","product":"WSO2-Synapse","vendor":"WSO2","versions":[{"lessThan":"2.1.7.wso2v182_93","status":"affected","version":"2.1.7.wso2v182","versionType":"custom"},{"lessThan":"2.1.7.wso2v143_119","status":"affected","version":"2.1.7.wso2v143","versionType":"custom"},{"lessThan":"2.1.7.wso2v183_62","status":"affected","version":"2.1.7.wso2v183","versionType":"custom"},{"lessThan":"2.1.7.wso2v319_7","status":"affected","version":"2.1.7.wso2v319","versionType":"custom"},{"lessThan":"2.1.7.wso2v227_88","status":"affected","version":"2.1.7.wso2v227","versionType":"custom"},{"lessThan":"2.1.7.wso2v271_60","status":"affected","version":"2.1.7.wso2v271","versionType":"custom"},{"lessThan":"4.0.0.wso2v119_3","status":"affected","version":"4.0.0.wso2v119","versionType":"custom"},{"lessThan":"4.0.0.wso2v105_3","status":"affected","version":"4.0.0.wso2v105","versionType":"custom"},{"lessThan":"4.0.0.wso2v20_63","status":"affected","version":"4.0.0.wso2v20","versionType":"custom"},{"lessThanOrEqual":"v4.0.0-wso2v*","status":"unaffected","version":"v4.0.0-wso2v121","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"1.2.0.163","versionStartIncluding":"1.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.103","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_micro_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.7","versionStartIncluding":"4.3.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.0.205","versionStartIncluding":"6.6.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.0.394","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"3.2.1.21","versionStartIncluding":"3.2.1","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.311","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.1.0.167","versionStartIncluding":"4.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.2.0.110","versionStartIncluding":"4.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionEndExcluding":"4.3.0.24","versionStartIncluding":"4.3.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.7.wso2v182_93","versionStartIncluding":"2.1.7.wso2v182","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.7.wso2v143_119","versionStartIncluding":"2.1.7.wso2v143","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.7.wso2v183_62","versionStartIncluding":"2.1.7.wso2v183","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.7.wso2v319_7","versionStartIncluding":"2.1.7.wso2v319","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.7.wso2v227_88","versionStartIncluding":"2.1.7.wso2v227","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"2.1.7.wso2v271_60","versionStartIncluding":"2.1.7.wso2v271","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.wso2v119_3","versionStartIncluding":"4.0.0.wso2v119","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.wso2v105_3","versionStartIncluding":"4.0.0.wso2v105","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.0.wso2v20_63","versionStartIncluding":"4.0.0.wso2v20","vulnerable":true},{"criteria":"cpe:2.3:a:wso2:wso2-synapse:*:*:*:*:*:*:*:*","versionEndIncluding":"v4.0.0-wso2v*","versionStartIncluding":"v4.0.0-wso2v121","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products."}],"value":"The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products."}],"impacts":[{"capecId":"CAPEC-28","descriptions":[{"lang":"en","value":"CAPEC-28 CAPEC-28: Access Control"}]},{"capecId":"CAPEC-17","descriptions":[{"lang":"en","value":"CAPEC-17 CAPEC-17: Input Validation"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20: Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-06T17:31:59.429Z","orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2"},"references":[{"tags":["vendor-advisory"],"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution</span></a> <br>"}],"value":"Follow the instructions given on  https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/#solution"}],"source":{"advisory":"WSO2-2024-3520","discovery":"INTERNAL"},"title":"Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products","x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","assignerShortName":"WSO2","cveId":"CVE-2024-6541","datePublished":"2026-08-06T17:31:59.429Z","dateReserved":"2024-07-08T09:20:26.394Z","dateUpdated":"2026-08-07T17:45:43.395Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-06 22:16:40","lastModifiedDate":"2026-10-27 18:10:00","problem_types":["CWE-20","CWE-20 CWE-20: Improper Input Validation"],"metrics":{"cvssMetricV31":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-07T17:45:31.638289Z","id":"CVE-2024-6541","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"6541","Ordinal":"1","Title":"Information Disclosure and Integrity Violation via Improper Mess","CVE":"CVE-2024-6541","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"6541","Ordinal":"1","NoteData":"The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.","Type":"Description","Title":"Information Disclosure and Integrity Violation via Improper Mess"}]}}}