CVE-2024-12139

Full vulnerability record from the local CVENow database.

Description

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.

Severity

MEDIUM

CVSS score

4.3 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

ed10eef1-636d-4fbe-9993-6890dfa878f8

Published

2026-11-02 18:18:33.763000

Last modified

2026-11-02 19:17:48.830000

View original CVE JSON

{
  "id": "CVE-2024-12139",
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "published": "2026-11-02T18:18:33.763",
  "lastModified": "2026-11-02T19:17:48.830",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions."
    }
  ],
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 API Manager",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "3.2.1",
              "versionType": "custom",
              "status": "unknown"
            },
            {
              "version": "3.2.1",
              "lessThan": "3.2.1.49",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "4.1.0",
              "lessThan": "4.1.0.210",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "4.2.0",
              "lessThan": "4.2.0.148",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "WSO2",
          "product": "WSO2 Identity Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.10.0",
              "versionType": "custom",
              "status": "unknown"
            },
            {
              "version": "5.10.0",
              "lessThan": "5.10.0.346",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "5.11.0",
              "lessThan": "5.11.0.385",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "6.0.0",
              "lessThan": "6.0.0.229",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "WSO2",
          "product": "WSO2 Identity Server as Key Manager",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.10.0",
              "versionType": "custom",
              "status": "unknown"
            },
            {
              "version": "5.10.0",
              "lessThan": "5.10.0.339",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-02T19:09:36.270401Z",
          "id": "CVE-2024-12139",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ]
}