CVE-2024-6429

Content Spoofing in Multiple WSO2 Products via Error Message Injection

State: Published
Severity: 4.3 Medium
Published: Sep 23, 2025
Updated: Sep 25, 2025
Reserved: Jul 1, 2024

Description

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.

By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	WSO2

Weaknesses

CWE-451 User Interface (UI) Misrepresentation of Critical Information

Affected Products

Product	Versions
WSO2 Identity Server as Key ManagerWSO2	5.10.0 to before 5.10.0.338Affected
WSO2 API ManagerWSO2	before 3.2.0Unknown 3.2.0 to before 3.2.0.409Affected 3.2.1 to before 3.2.1.33Affected 4.0.0 to before 4.0.0.327Affected 4.1.0 to before 4.1.0.188Affected 4.2.0 to before 4.2.0.128Affected 4.3.0 to before 4.3.0.38Affected 4.4.0 to before 4.4.0.4Affected
WSO2 Identity ServerWSO2	before 5.10.0Unknown 5.10.0 to before 5.10.0.314Affected 5.11.0 to before 5.11.0.359Affected 6.0.0 to before 6.0.0.203Affected 6.1.0 to before 6.1.0.176Affected 7.0.0 to before 7.0.0.48Affected

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.