Vigie VulnDBEuropean-hosted Vulnerability DB

CVE-2024-6541

Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products

En bref

Sévérité
MEDIUM 6.8
EPSS
EPSS 0.34 % · centile 27 (2026-10-27)
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
WSO2
Statut NVD
Deferred

Description

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NWSO2
CVSS 3.1MEDIUM 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NNVD · ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Faiblesses (CWE)

Références européennes

Produits affectés

ProduitVersions
WSO2 · WSO2 Micro Integratorunknown 0 < 1.2.0 ; affected 1.2.0 < 1.2.0.163 ; affected 4.1.0 < 4.1.0.103 ; affected 4.3.0 < 4.3.0.7
WSO2 · WSO2 Enterprise Integratorunknown 0 < 6.6.0 ; affected 6.6.0 < 6.6.0.205
WSO2 · WSO2 API Managerunknown 0 < 3.2.0 ; affected 3.2.0 < 3.2.0.394 ; affected 3.2.1 < 3.2.1.21 ; affected 4.0.0 < 4.0.0.311 ; affected 4.1.0 < 4.1.0.167 ; affected 4.2.0 < 4.2.0.110
WSO2 · WSO2-Synapseaffected 2.1.7.wso2v182 < 2.1.7.wso2v182_93 ; affected 2.1.7.wso2v143 < 2.1.7.wso2v143_119 ; affected 2.1.7.wso2v183 < 2.1.7.wso2v183_62 ; affected 2.1.7.wso2v319 < 2.1.7.wso2v319_7 ; affected 2.1.7.wso2v227 < 2.1.7.wso2v227_88 ; affected 2.1.7.wso2v271 < 2.1.7.wso2v271_60

Références

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD