CVE-2024-6429
published 2025-09-23CVE-2024-6429: A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed…
PriorityP421medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.20%
10.0th percentile
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.
By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wso2 | api_manager | — | — |
| wso2 | api_manager | — | — |
| wso2 | api_manager | — | — |
| wso2 | api_manager | — | — |
| wso2 | api_manager | — | — |
| wso2 | api_manager | — | — |
| wso2 | api_manager | — | — |
| wso2 | identity_server | — | — |
| wso2 | identity_server | — | — |
| wso2 | identity_server | — | — |
| wso2 | identity_server | — | — |
| wso2 | identity_server | — | — |
| wso2 | wso2_api_manager | >= 3.2.0 < 3.2.0.409 | 3.2.0.409 |
| wso2 | wso2_api_manager | >= 3.2.1 < 3.2.1.33 | 3.2.1.33 |
| wso2 | wso2_api_manager | >= 4.0.0 < 4.0.0.327 | 4.0.0.327 |
| wso2 | wso2_api_manager | >= 4.1.0 < 4.1.0.188 | 4.1.0.188 |
| wso2 | wso2_api_manager | >= 4.2.0 < 4.2.0.128 | 4.2.0.128 |
| wso2 | wso2_api_manager | >= 4.3.0 < 4.3.0.38 | 4.3.0.38 |
| wso2 | wso2_api_manager | >= 4.4.0 < 4.4.0.4 | 4.4.0.4 |
| wso2 | wso2_identity_server | >= 5.10.0 < 5.10.0.314 | 5.10.0.314 |
| wso2 | wso2_identity_server | >= 5.11.0 < 5.11.0.359 | 5.11.0.359 |
| wso2 | wso2_identity_server | >= 6.0.0 < 6.0.0.203 | 6.0.0.203 |
| wso2 | wso2_identity_server | >= 6.1.0 < 6.1.0.176 | 6.1.0.176 |
| wso2 | wso2_identity_server | >= 7.0.0 < 7.0.0.48 | 7.0.0.48 |
| wso2 | wso2_identity_server_as_key_manager | >= 5.10.0 < 5.10.0.338 | 5.10.0.338 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
WSO2 Identity Server Apps allows content spoofing in logs
osv·2025-09-23
CVE-2024-6429 [MEDIUM] WSO2 Identity Server Apps allows content spoofing in logs
WSO2 Identity Server Apps allows content spoofing in logs
A content spoofing issue exists in WSO2 Identity Server Apps, specifically in the Authentication Portal, due to improper handling of authentication error messages. When an authentication failure occurs, the portal previously accepted an `authFailureMsg` value supplied via URL and rendered it in the UI without validating it against the resource bundle. An attacker can craft a link that causes the portal to display attacker-controlled text in the error banner, enabling UI misrepresentation and social-engineering.
The fix validates the message key against the resource bundle and encodes input before rendering. Upgrade to `org.wso2.identity.apps:authentication-portal` **2.4.4** or later to remediate.
GHSA
WSO2 Identity Server Apps allows content spoofing in logs
ghsa·2025-09-23
CVE-2024-6429 [MEDIUM] CWE-451 WSO2 Identity Server Apps allows content spoofing in logs
WSO2 Identity Server Apps allows content spoofing in logs
A content spoofing issue exists in WSO2 Identity Server Apps, specifically in the Authentication Portal, due to improper handling of authentication error messages. When an authentication failure occurs, the portal previously accepted an `authFailureMsg` value supplied via URL and rendered it in the UI without validating it against the resource bundle. An attacker can craft a link that causes the portal to display attacker-controlled text in the error banner, enabling UI misrepresentation and social-engineering.
The fix validates the message key against the resource bundle and encodes input before rendering. Upgrade to `org.wso2.identity.apps:authentication-portal` **2.4.4** or later to remediate.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-23
Published