CVE-2024-6429

Content Spoofing in Multiple WSO2 Products via Error Message Injection

En bref

Sévérité: MEDIUM 4.3
EPSS: EPSS 0.21 % · centile 12 (2026-10-27)
État: PUBLISHED
Publiée: 2025-09-23
Mise à jour: 2025-09-25
Attribuée par: WSO2
Statut NVD: Analyzed

Description

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	WSO2
CVSS 3.1	MEDIUM 4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	NVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Faiblesses (CWE)

CWE-451

Avis

GHSA-r6f3-55wj-g9p3 — WSO2 Identity Server Apps allows content spoofing in logs

Références européennes

ENISA EUVD · EUVD-2024-55023
GCVE · GCVE-0-2024-6429

Configurations affectées (CPE NVD)

cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*
cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
WSO2 · WSO2 Identity Server as Key Manager	affected 5.10.0 < 5.10.0.338
WSO2 · WSO2 API Manager	unknown 0 < 3.2.0 ; affected 3.2.0 < 3.2.0.409 ; affected 3.2.1 < 3.2.1.33 ; affected 4.0.0 < 4.0.0.327 ; affected 4.1.0 < 4.1.0.188 ; affected 4.2.0 < 4.2.0.128
WSO2 · WSO2 Identity Server	unknown 0 < 5.10.0 ; affected 5.10.0 < 5.10.0.314 ; affected 5.11.0 < 5.11.0.359 ; affected 6.0.0 < 6.0.0.203 ; affected 6.1.0 < 6.1.0.176 ; affected 7.0.0 < 7.0.0.48

Références

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD