CVE-2024-4412

published 2026-10-19

CVE-2024-4412: The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to…

Priority P4 16 low 2.7 CVSS 3.1

AV N AC L PR H UI N S U C L I N A N

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.

Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Affected

46 ranges · showing 25

Vendor	Product	Version range	Fixed in
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.276	3.1.0.276
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.366	3.2.0.366
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.18	3.2.1.18
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.307	4.0.0.307
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.169	4.1.0.169
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.108	4.2.0.108
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.20	4.3.0.20
wso2	wso2_carbon_identity_application_authentication_framework	>= 5.18.248 < 5.18.248.20	5.18.248.20
wso2	wso2_carbon_identity_application_authentication_framework	>= 5.24.8 < 5.24.8.9	5.24.8.9
wso2	wso2_carbon_identity_application_authentication_framework	>= 5.25.705 < 5.25.705.8	5.25.705.8
wso2	wso2_carbon_identity_recovery_management	>= 1.4.100 < 1.4.100.6	1.4.100.6
wso2	wso2_carbon_identity_recovery_management	>= 1.4.72 < 1.4.72.66	1.4.72.66
wso2	wso2_carbon_identity_recovery_management	>= 1.7.2 < 1.7.2.2	1.7.2.2
wso2	wso2_carbon_identity_recovery_management	>= 1.8.107 < 1.8.107.1	1.8.107.1
wso2	wso2_carbon_identity_user_store	>= 1.0.190 < 1.0.190.14	1.0.190.14
wso2	wso2_carbon_identity_user_store	>= 1.2.23 < 1.2.23.4	1.2.23.4
wso2	wso2_carbon_identity_user_store	>= 1.2.3 < 1.2.3.4	1.2.3.4
wso2	wso2_carbon_identity_user_store_configuration	>= 5.14.127 < 5.14.127.8	5.14.127.8
wso2	wso2_carbon_identity_user_store_configuration	>= 5.17.118 < 5.17.118.6	5.17.118.6
wso2	wso2_carbon_identity_user_store_configuration	>= 5.17.5 < 5.17.5.266	5.17.5.266
wso2	wso2_carbon_identity_user_store_configuration	>= 5.18.187 < 5.18.187.253	5.18.187.253
wso2	wso2_carbon_identity_user_store_configuration	>= 5.18.248 < 5.18.248.20	5.18.248.20
wso2	wso2_carbon_identity_user_store_configuration	>= 5.23.8 < 5.23.8.178	5.23.8.178
wso2	wso2_carbon_identity_user_store_configuration	>= 5.24.8 < 5.24.8.9	5.24.8.9
wso2	wso2_carbon_identity_user_store_configuration	>= 5.25.705 < 5.25.705.8	5.25.705.8

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94