Riskcovery

CVE-2024-4412

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

State
Published
Severity
2.7 Low
Published
Oct 19, 2026
Updated
Oct 20, 2026
Reserved
May 2, 2024

Read the record on cve.org

Description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.

Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Scores

CVSSScoreVectorSource
3.12.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NWSO2

Weaknesses

  • CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

ProductVersions
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.205Affected
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.276Affected
  • 3.2.0 to before 3.2.0.366Affected
  • 3.2.1 to before 3.2.1.18Affected
  • 4.0.0 to before 4.0.0.307Affected
  • 4.1.0 to before 4.1.0.169Affected
  • 4.2.0 to before 4.2.0.108Affected
  • 4.3.0 to before 4.3.0.20Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.346Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.297Affected
  • 5.11.0 to before 5.11.0.337Affected
  • 6.0.0 to before 6.0.0.189Affected
  • 6.1.0 to before 6.1.0.149Affected
  • 7.0.0 to before 7.0.0.15Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.293Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.326Affected
WSO2 Carbon Identity User Store Configuration UIWSO2
  • 5.14.127 to before 5.14.127.8Affected
  • 5.17.5 to before 5.17.5.266Affected
  • 5.17.118 to before 5.17.118.6Affected
  • 5.18.187 to before 5.18.187.253Affected
  • 5.18.248 to before 5.18.248.20Affected
  • 5.23.8 to before 5.23.8.178Affected
  • 5.24.8 to before 5.24.8.9Affected
  • 5.25.92 to before 5.25.92.81Affected
  • 5.25.705 to before 5.25.705.8Affected
  • 7.0.78 to before 7.0.78.12Affected
WSO2 Carbon Identity User Store ConfigurationWSO2
  • 5.14.127 to before 5.14.127.8Affected
  • 5.17.5 to before 5.17.5.266Affected
  • 5.17.118 to before 5.17.118.6Affected
  • 5.18.187 to before 5.18.187.253Affected
  • 5.18.248 to before 5.18.248.20Affected
  • 5.23.8 to before 5.23.8.178Affected
  • 5.24.8 to before 5.24.8.9Affected
  • 5.25.92 to before 5.25.92.81Affected
  • 5.25.705 to before 5.25.705.8Affected
  • 7.0.78 to before 7.0.78.12Affected
WSO2 Carbon Identity Recovery ManagementWSO2
  • 1.4.72 to before 1.4.72.66Affected
  • 1.4.100 to before 1.4.100.6Affected
  • 1.7.2 to before 1.7.2.2Affected
  • 1.8.107 to before 1.8.107.1Affected
WSO2 Carbon Identity Application Authentication FrameworkWSO2
  • 5.18.248 to before 5.18.248.20Affected
  • 5.24.8 to before 5.24.8.9Affected
  • 5.25.705 to before 5.25.705.8Affected
WSO2 Carbon Identity User StoreWSO2
  • 1.0.190 to before 1.0.190.14Affected
  • 1.2.3 to before 1.2.3.4Affected
  • 1.2.23 to before 1.2.23.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.