CVE-2024-12141

Full vulnerability record from the local CVENow database.

Description

The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.

Severity

MEDIUM

CVSS score

4.3 (v3.1)

Vulnerability status

Deferred

Source identifier

ed10eef1-636d-4fbe-9993-6890dfa878f8

Published

2026-11-02 13:17:29.440000

Last modified

2026-11-02 13:17:30.587000

View original CVE JSON

{
  "id": "CVE-2024-12141",
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "published": "2026-11-02T13:17:29.440",
  "lastModified": "2026-11-02T13:17:30.587",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted.\n\nAn attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft."
    }
  ],
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 Identity Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "5.10.0",
              "versionType": "custom",
              "status": "unknown"
            },
            {
              "version": "5.10.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "5.11.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "6.0.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "6.1.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.0.0",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "7.1.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3696/",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ]
}