Riskcovery

CVE-2024-6541

Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

State
Published
Severity
6.8 Medium
Published
Aug 6, 2026
Updated
Aug 7, 2026
Reserved
Jul 8, 2024

Read the record on cve.org

Description

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.

This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

Scores

CVSSScoreVectorSource
3.16.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NWSO2

Weaknesses

  • CWE-20 Improper Input Validation

Affected Products

ProductVersions
WSO2 Micro IntegratorWSO2
  • before 1.2.0Unknown
  • 1.2.0 to before 1.2.0.163Affected
  • 4.1.0 to before 4.1.0.103Affected
  • 4.3.0 to before 4.3.0.7Affected
WSO2 Enterprise IntegratorWSO2
  • before 6.6.0Unknown
  • 6.6.0 to before 6.6.0.205Affected
WSO2 API ManagerWSO2
  • before 3.2.0Unknown
  • 3.2.0 to before 3.2.0.394Affected
  • 3.2.1 to before 3.2.1.21Affected
  • 4.0.0 to before 4.0.0.311Affected
  • 4.1.0 to before 4.1.0.167Affected
  • 4.2.0 to before 4.2.0.110Affected
  • 4.3.0 to before 4.3.0.24Affected
WSO2-SynapseWSO2
  • 2.1.7.wso2v182 to before 2.1.7.wso2v182_93Affected
  • 2.1.7.wso2v143 to before 2.1.7.wso2v143_119Affected
  • 2.1.7.wso2v183 to before 2.1.7.wso2v183_62Affected
  • 2.1.7.wso2v319 to before 2.1.7.wso2v319_7Affected
  • 2.1.7.wso2v227 to before 2.1.7.wso2v227_88Affected
  • 2.1.7.wso2v271 to before 2.1.7.wso2v271_60Affected
  • 4.0.0.wso2v119 to before 4.0.0.wso2v119_3Affected
  • 4.0.0.wso2v105 to before 4.0.0.wso2v105_3Affected
  • 4.0.0.wso2v20 to before 4.0.0.wso2v20_63Affected
  • v4.0.0-wso2v121 through v4.0.0-wso2v*Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.