Expression Language Injection Vulnerability in WSO2 Products
CVE-2024-4412

2.7LOW

Key Information:

Vendor

Wso2

Status
Wso2 Enterprise Integrator
Wso2 Api Manager
Wso2 Open Banking Iam
Wso2 Identity Server
Vendor
CVE Published:
19 October 2026

What is CVE-2024-4412?

A vulnerability exists in WSO2 products where the software improperly validates user-supplied data, permitting the injection of malicious Expression Language (EL) code. This flaw can enable unauthorized execution of operations within the affected deployment, particularly if exploited with administrator privileges. Although the impact is limited due to restrictions on EL usage to certain read operations, it highlights essential security concerns that warrant immediate attention.

Affected Version(s)

WSO2 API Manager 3.1.0 < 3.1.0.276

WSO2 API Manager 3.2.0 < 3.2.0.366

WSO2 API Manager 3.2.1 < 3.2.1.18

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory
https://github.com/wso2-extensions/identity-governance/pu...
patch
https://github.com/wso2/carbon-identity-framework/pull/5895
patch

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.