Riskcovery

CVE-2024-10302

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

State
Published
Severity
4.0 Medium
Published
Aug 6, 2026
Updated
Aug 6, 2026
Reserved
Oct 23, 2024

Read the record on cve.org

Description

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes.

Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.

Scores

CVSSScoreVectorSource
3.14.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:NWSO2

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
WSO2 API Control PlaneWSO2
  • 4.5.0 to before 4.5.0.10Affected
WSO2 Traffic ManagerWSO2
  • 4.5.0 to before 4.5.0.9Affected
WSO2 Universal GatewayWSO2
  • 4.5.0 to before 4.5.0.9Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.331Affected
  • 3.2.0 to before 3.2.0.427Affected
  • 3.2.1 to before 3.2.1.39Affected
  • 4.0.0 to before 4.0.0.318Affected
  • 4.1.0 to before 4.1.0.200Affected
  • 4.2.0 to before 4.2.0.138Affected
  • 4.3.0 to before 4.3.0.51Affected
  • 4.5.0 to before 4.5.0.9Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.400Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.351Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.358Affected
  • 5.11.0 to before 5.11.0.379Affected
WSO2 Carbon Identity Recovery ManagementWSO2
  • 1.4.1 to before 1.4.1.72Affected
  • 1.4.72 to before 1.4.72.68Affected
  • 1.4.100 to before 1.4.100.8Affected
  • 1.4.102 to before 1.4.102.2Affected
  • 1.7.2 to before 1.7.2.4Affected
  • 1.8.107 to before 1.8.107.2Affected
  • 1.8.108 to before 1.8.108.4Affected
  • 1.6.380 through 1.6.*Not affected
  • 1.8.109 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.