p PatchFirst

CVE-2024-4412

CVE-2024-4412 · Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

CVSS 2.7 · Low · EPSS 0.3% · Fix available

Published
Updated

Affected products and versions

  • wso2 enterprise integrator

    Versions
    • ≥ 0, < 6.6.0: Unknown (custom)
    • ≥ 6.6.0, < 6.6.0.205: Affected (custom)

    Update to 6.6.0.205

  • wso2 api manager

    Versions
    • ≥ 0, < 3.1.0: Unknown (custom)
    • ≥ 3.1.0, < 3.1.0.276: Affected (custom)
    • ≥ 3.2.0, < 3.2.0.366: Affected (custom)
    • ≥ 3.2.1, < 3.2.1.18: Affected (custom)
    • ≥ 4.0.0, < 4.0.0.307: Affected (custom)
    • ≥ 4.1.0, < 4.1.0.169: Affected (custom)
    • ≥ 4.2.0, < 4.2.0.108: Affected (custom)
    • ≥ 4.3.0, < 4.3.0.20: Affected (custom)

    Update to 3.1.0.276; Update to 3.2.0.366; Update to 3.2.1.18; Update to 4.0.0.307; Update to 4.1.0.169; Update to 4.2.0.108; Update to 4.3.0.20

  • wso2 open banking iam

    Versions
    • ≥ 0, < 2.0.0: Unknown (custom)
    • ≥ 2.0.0, < 2.0.0.346: Affected (custom)

    Update to 2.0.0.346

  • wso2 identity server

    Versions
    • ≥ 0, < 5.10.0: Unknown (custom)
    • ≥ 5.10.0, < 5.10.0.297: Affected (custom)
    • ≥ 5.11.0, < 5.11.0.337: Affected (custom)
    • ≥ 6.0.0, < 6.0.0.189: Affected (custom)
    • ≥ 6.1.0, < 6.1.0.149: Affected (custom)
    • ≥ 7.0.0, < 7.0.0.15: Affected (custom)

    Update to 5.10.0.297; Update to 5.11.0.337; Update to 6.0.0.189; Update to 6.1.0.149; Update to 7.0.0.15

  • wso2 identity server as key manager

    Versions
    • ≥ 0, < 5.10.0: Unknown (custom)
    • ≥ 5.10.0, < 5.10.0.293: Affected (custom)

    Update to 5.10.0.293

  • wso2 open banking am

    Versions
    • ≥ 0, < 2.0.0: Unknown (custom)
    • ≥ 2.0.0, < 2.0.0.326: Affected (custom)

    Update to 2.0.0.326

  • wso2 carbon identity user store configuration ui

    Versions
    • ≥ 5.14.127, < 5.14.127.8: Affected (custom)
    • ≥ 5.17.5, < 5.17.5.266: Affected (custom)
    • ≥ 5.17.118, < 5.17.118.6: Affected (custom)
    • ≥ 5.18.187, < 5.18.187.253: Affected (custom)
    • ≥ 5.18.248, < 5.18.248.20: Affected (custom)
    • ≥ 5.23.8, < 5.23.8.178: Affected (custom)
    • ≥ 5.24.8, < 5.24.8.9: Affected (custom)
    • ≥ 5.25.92, < 5.25.92.81: Affected (custom)
    • ≥ 5.25.705, < 5.25.705.8: Affected (custom)
    • ≥ 7.0.78, < 7.0.78.12: Affected (custom)

    Update to 5.14.127.8; Update to 5.17.118.6; Update to 5.17.5.266; Update to 5.18.187.253; Update to 5.18.248.20; Update to 5.23.8.178; Update to 5.24.8.9; Update to 5.25.705.8; Update to 5.25.92.81; Update to 7.0.78.12

  • wso2 carbon identity user store configuration

    Versions
    • ≥ 5.14.127, < 5.14.127.8: Affected (custom)
    • ≥ 5.17.5, < 5.17.5.266: Affected (custom)
    • ≥ 5.17.118, < 5.17.118.6: Affected (custom)
    • ≥ 5.18.187, < 5.18.187.253: Affected (custom)
    • ≥ 5.18.248, < 5.18.248.20: Affected (custom)
    • ≥ 5.23.8, < 5.23.8.178: Affected (custom)
    • ≥ 5.24.8, < 5.24.8.9: Affected (custom)
    • ≥ 5.25.92, < 5.25.92.81: Affected (custom)
    • ≥ 5.25.705, < 5.25.705.8: Affected (custom)
    • ≥ 7.0.78, < 7.0.78.12: Affected (custom)

    Update to 5.14.127.8; Update to 5.17.118.6; Update to 5.17.5.266; Update to 5.18.187.253; Update to 5.18.248.20; Update to 5.23.8.178; Update to 5.24.8.9; Update to 5.25.705.8; Update to 5.25.92.81; Update to 7.0.78.12

  • wso2 carbon identity recovery management

    Versions
    • ≥ 1.4.72, < 1.4.72.66: Affected (custom)
    • ≥ 1.4.100, < 1.4.100.6: Affected (custom)
    • ≥ 1.7.2, < 1.7.2.2: Affected (custom)
    • ≥ 1.8.107, < 1.8.107.1: Affected (custom)

    Update to 1.4.100.6; Update to 1.4.72.66; Update to 1.7.2.2; Update to 1.8.107.1

  • wso2 carbon identity application authentication framework

    Versions
    • ≥ 5.18.248, < 5.18.248.20: Affected (custom)
    • ≥ 5.24.8, < 5.24.8.9: Affected (custom)
    • ≥ 5.25.705, < 5.25.705.8: Affected (custom)

    Update to 5.18.248.20; Update to 5.24.8.9; Update to 5.25.705.8

  • wso2 carbon identity user store

    Versions
    • ≥ 1.0.190, < 1.0.190.14: Affected (custom)
    • ≥ 1.2.3, < 1.2.3.4: Affected (custom)
    • ≥ 1.2.23, < 1.2.23.4: Affected (custom)

    Update to 1.0.190.14; Update to 1.2.23.4; Update to 1.2.3.4

Original sources

Check your server →