CVE-2024-6541: The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated…

PriorityP339medium6.8CVSS 3.1

AVNACHPRLUINSUCHIHAN

EPSS

0.34%

25.9th percentile

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

Affected

19 ranges

Vendor	Product	Version range	Fixed in
wso2	wso2-synapse	>= 2.1.7.wso2v143 < 2.1.7.wso2v143_119	2.1.7.wso2v143_119
wso2	wso2-synapse	>= 2.1.7.wso2v182 < 2.1.7.wso2v182_93	2.1.7.wso2v182_93
wso2	wso2-synapse	>= 2.1.7.wso2v183 < 2.1.7.wso2v183_62	2.1.7.wso2v183_62
wso2	wso2-synapse	>= 2.1.7.wso2v227 < 2.1.7.wso2v227_88	2.1.7.wso2v227_88
wso2	wso2-synapse	>= 2.1.7.wso2v271 < 2.1.7.wso2v271_60	2.1.7.wso2v271_60
wso2	wso2-synapse	>= 2.1.7.wso2v319 < 2.1.7.wso2v319_7	2.1.7.wso2v319_7
wso2	wso2-synapse	>= 4.0.0.wso2v105 < 4.0.0.wso2v105_3	4.0.0.wso2v105_3
wso2	wso2-synapse	>= 4.0.0.wso2v119 < 4.0.0.wso2v119_3	4.0.0.wso2v119_3
wso2	wso2-synapse	>= 4.0.0.wso2v20 < 4.0.0.wso2v20_63	4.0.0.wso2v20_63
wso2	wso2_api_manager	>= 3.2.0 < 3.2.0.394	3.2.0.394
wso2	wso2_api_manager	>= 3.2.1 < 3.2.1.21	3.2.1.21
wso2	wso2_api_manager	>= 4.0.0 < 4.0.0.311	4.0.0.311
wso2	wso2_api_manager	>= 4.1.0 < 4.1.0.167	4.1.0.167
wso2	wso2_api_manager	>= 4.2.0 < 4.2.0.110	4.2.0.110
wso2	wso2_api_manager	>= 4.3.0 < 4.3.0.24	4.3.0.24
wso2	wso2_enterprise_integrator	>= 6.6.0 < 6.6.0.205	6.6.0.205
wso2	wso2_micro_integrator	>= 1.2.0 < 1.2.0.163	1.2.0.163
wso2	wso2_micro_integrator	>= 4.1.0 < 4.1.0.103	4.1.0.103
wso2	wso2_micro_integrator	>= 4.3.0 < 4.3.0.7	4.3.0.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.