Riskcovery

CVE-2024-6423

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

State
Published
Severity
4.0 Medium
Published
Oct 21, 2026
Updated
Oct 30, 2026
Reserved
Jul 1, 2024

Read the record on cve.org

Description

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.

If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

Scores

CVSSScoreVectorSource
3.14.0 MediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:NWSO2

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
WSO2 API ManagerWSO2
  • before 3.1.0Unknown
  • 3.1.0 to before 3.1.0.313Affected
  • 3.2.0 to before 3.2.0.406Affected
  • 3.2.1 to before 3.2.1.30Affected
  • 4.0.0 to before 4.0.0.324Affected
  • 4.1.0 to before 4.1.0.185Affected
  • 4.2.0 to before 4.2.0.124Affected
  • 4.3.0 to before 4.3.0.36Affected
  • 4.4.0 to before 4.4.0.2Affected
WSO2 Open Banking AMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.363Affected
WSO2 Identity ServerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.337Affected
  • 5.11.0 to before 5.11.0.384Affected
  • 6.0.0 to before 6.0.0.213Affected
  • 6.1.0 to before 6.1.0.211Affected
  • 7.0.0 to before 7.0.0.50Affected
WSO2 Identity Server as Key ManagerWSO2
  • before 5.10.0Unknown
  • 5.10.0 to before 5.10.0.329Affected
WSO2 Open Banking IAMWSO2
  • before 2.0.0Unknown
  • 2.0.0 to before 2.0.0.381Affected
WSO2 Carbon Identity ApplicationWSO2
  • 6.3.0 to before 6.3.0.18Affected
  • 6.3.11 to before 6.3.11.23Affected
  • 6.3.58 to before 6.3.58.1Affected
  • 6.5.0 to before 6.5.0.5Affected
  • 6.6.0 to before 6.6.0.1Affected
  • 6.7.8 to before 6.7.8.4Affected
  • 6.7.32 to before 6.7.32.1Affected
  • x and laterNot affected
WSO2 Carbon Identity CoreWSO2
  • 5.17.5 to before 5.17.5.286Affected
  • 5.17.118 to before 5.17.118.11Affected
  • 5.18.187 to before 5.18.187.263Affected
  • 5.18.248 to before 5.18.248.23Affected
  • 5.23.8 to before 5.23.8.189Affected
  • 5.24.8 to before 5.24.8.12Affected
  • 5.25.92 to before 5.25.92.91Affected
  • 5.25.92 to before 5.25.92.118Affected
  • 5.25.705 to before 5.25.705.11Affected
  • 5.25.713 to before 5.25.713.2Affected
  • 7.0.78 to before 7.0.78.27Affected
  • x and laterNot affected
WSO2 Carbon Identity OauthWSO2
  • 6.4.2 to before 6.4.2.142Affected
  • 6.4.176 to before 6.4.176.20Affected
  • 6.4.180 to before 6.4.180.8Affected
  • 6.8.0 to before 6.8.0.40Affected
  • 6.9.6 to before 6.9.6.16Affected
  • 6.11.21 to before 6.11.21.44Affected
  • 6.13.16 to before 6.13.16.6Affected
  • 6.13.19 to before 6.13.19.2Affected
  • 7.0.26 to before 7.0.26.18Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.