Insecure Input Validation in WSO2 Product
CVE-2024-6423

4MEDIUM

Key Information:

Vendor

Wso2

Status
Wso2 Api Manager
Wso2 Open Banking Am
Wso2 Identity Server
Wso2 Identity Server As Key Manager
Vendor
CVE Published:
21 October 2026

What is CVE-2024-6423?

The WSO2 product permits the passing of user-supplied input through URL parameters without adequate validation constraints. This oversight may result in sensitive data being inadvertently logged, heightening the risk of exposing confidential information. If users mistakenly transmit sensitive data, it may be captured in server access logs, thereby compromising system security and privacy. Organizations using affected WSO2 products should enforce stringent input validation to mitigate potential risks presented by this flaw.

Affected Version(s)

WSO2 API Manager 3.1.0 < 3.1.0.313

WSO2 API Manager 3.2.0 < 3.2.0.406

WSO2 API Manager 3.2.1 < 3.2.1.30

References

https://security.docs.wso2.com/en/latest/security-announc...
vendor-advisory

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.