CVE-2024-5139: The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This…

PriorityP426medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.286	3.1.0.286
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.376	3.2.0.376
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.10	3.2.1.10
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.299	4.0.0.299
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.159	4.1.0.159
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.91	4.2.0.91
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.6	4.3.0.6
wso2	wso2_carbon_user_management_ui	>= 5.14.127 < 5.14.127.6	5.14.127.6
wso2	wso2_carbon_user_management_ui	>= 5.17.118 < 5.17.118.3	5.17.118.3
wso2	wso2_carbon_user_management_ui	>= 5.17.5 < 5.17.5.273	5.17.5.273
wso2	wso2_carbon_user_management_ui	>= 5.18.187 < 5.18.187.260	5.18.187.260
wso2	wso2_carbon_user_management_ui	>= 5.18.248 < 5.18.248.12	5.18.248.12
wso2	wso2_carbon_user_management_ui	>= 5.23.8 < 5.23.8.191	5.23.8.191
wso2	wso2_carbon_user_management_ui	>= 5.24.8 < 5.24.8.3	5.24.8.3
wso2	wso2_carbon_user_management_ui	>= 5.25.705 < 5.25.705.3	5.25.705.3
wso2	wso2_carbon_user_management_ui	>= 5.25.92 < 5.25.92.99	5.25.92.99
wso2	wso2_carbon_user_management_ui	>= 7.0.78 < 7.0.78.43	7.0.78.43
wso2	wso2_enterprise_integrator	>= 6.6.0 < 6.6.0.204	6.6.0.204
wso2	wso2_identity_server	>= 5.10.0 < 5.10.0.310	5.10.0.310
wso2	wso2_identity_server	>= 6.0.0 < 6.0.0.212	6.0.0.212
wso2	wso2_identity_server	>= 6.1.0 < 6.1.0.195	6.1.0.195
wso2	wso2_identity_server	>= 7.0.0 < 7.0.0.64	7.0.0.64
wso2	wso2_identity_server_as_key_manager	>= 5.10.0 < 5.10.0.306	5.10.0.306
wso2	wso2_open_banking_am	>= 2.0.0 < 2.0.0.336	2.0.0.336
wso2	wso2_open_banking_iam	>= 2.0.0 < 2.0.0.357	2.0.0.357

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.