Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2024-6541

Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

At a glance

Severity
MEDIUM 6.8
EPSS
EPSS 0.34 % · percentile 27 (2026-10-27)
State
PUBLISHED
Published
Updated
Assigner
WSO2
NVD status
Deferred

Description

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NWSO2
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NNVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Weaknesses (CWE)

European references

Affected products

ProductVersions
WSO2 · WSO2 Micro Integratorunknown 0 < 1.2.0 ; affected 1.2.0 < 1.2.0.163 ; affected 4.1.0 < 4.1.0.103 ; affected 4.3.0 < 4.3.0.7
WSO2 · WSO2 Enterprise Integratorunknown 0 < 6.6.0 ; affected 6.6.0 < 6.6.0.205
WSO2 · WSO2 API Managerunknown 0 < 3.2.0 ; affected 3.2.0 < 3.2.0.394 ; affected 3.2.1 < 3.2.1.21 ; affected 4.0.0 < 4.0.0.311 ; affected 4.1.0 < 4.1.0.167 ; affected 4.2.0 < 4.2.0.110
WSO2 · WSO2-Synapseaffected 2.1.7.wso2v182 < 2.1.7.wso2v182_93 ; affected 2.1.7.wso2v143 < 2.1.7.wso2v143_119 ; affected 2.1.7.wso2v183 < 2.1.7.wso2v183_62 ; affected 2.1.7.wso2v319 < 2.1.7.wso2v319_7 ; affected 2.1.7.wso2v227 < 2.1.7.wso2v227_88 ; affected 2.1.7.wso2v271 < 2.1.7.wso2v271_60

References

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD