CVE-2024-6423: The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not…

PriorityP418medium4CVSS 3.1

AVLACHPRHUIRSUCHINAN

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

Affected

43 ranges· showing 25

Vendor	Product	Version range	Fixed in
wso2	wso2_api_manager	>= 3.1.0 < 3.1.0.313	3.1.0.313
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.406	3.2.0.406
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.30	3.2.1.30
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.324	4.0.0.324
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.185	4.1.0.185
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.124	4.2.0.124
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.36	4.3.0.36
wso2	wso2_api_manager	>= 4.4.0 < 4.4.0.2	4.4.0.2
wso2	wso2_carbon_identity_application	>= 6.3.0 < 6.3.0.18	6.3.0.18
wso2	wso2_carbon_identity_application	>= 6.3.11 < 6.3.11.23	6.3.11.23
wso2	wso2_carbon_identity_application	>= 6.3.58 < 6.3.58.1	6.3.58.1
wso2	wso2_carbon_identity_application	>= 6.5.0 < 6.5.0.5	6.5.0.5
wso2	wso2_carbon_identity_application	>= 6.6.0 < 6.6.0.1	6.6.0.1
wso2	wso2_carbon_identity_application	>= 6.7.32 < 6.7.32.1	6.7.32.1
wso2	wso2_carbon_identity_application	>= 6.7.8 < 6.7.8.4	6.7.8.4
wso2	wso2_carbon_identity_core	>= 5.17.118 < 5.17.118.11	5.17.118.11
wso2	wso2_carbon_identity_core	>= 5.17.5 < 5.17.5.286	5.17.5.286
wso2	wso2_carbon_identity_core	>= 5.18.187 < 5.18.187.263	5.18.187.263
wso2	wso2_carbon_identity_core	>= 5.18.248 < 5.18.248.23	5.18.248.23
wso2	wso2_carbon_identity_core	>= 5.23.8 < 5.23.8.189	5.23.8.189
wso2	wso2_carbon_identity_core	>= 5.24.8 < 5.24.8.12	5.24.8.12
wso2	wso2_carbon_identity_core	>= 5.25.705 < 5.25.705.11	5.25.705.11
wso2	wso2_carbon_identity_core	>= 5.25.713 < 5.25.713.2	5.25.713.2
wso2	wso2_carbon_identity_core	>= 5.25.92 < 5.25.92.91	5.25.92.91
wso2	wso2_carbon_identity_core	>= 5.25.92 < 5.25.92.118	5.25.92.118

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.