CVE-2024-4989

{
  "id": "CVE-2024-4989",
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
  "published": "2026-10-21T14:17:04.010",
  "lastModified": "2026-10-30T17:17:09.350",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.\n\nExploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm."
    },
    {
      "lang": "es",
      "value": "El parámetro de URL de callback en WSO2 API Manager no valida la entrada proporcionada por el usuario, lo que permite que sea controlado por actores maliciosos.\n\nLa explotación de esta vulnerabilidad podría llevar a que los usuarios sean redirigidos a páginas web controladas por el atacante. Esto puede usarse en conjunto con técnicas de ingeniería social para engañar a los usuarios para que interactúen con enlaces maliciosos, lo que podría resultar en ataques de phishing destinados a adquirir información sensible o causar otros daños."
    }
  ],
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 API Manager",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "4.1.0",
              "versionType": "custom",
              "status": "unknown"
            },
            {
              "version": "4.1.0",
              "lessThan": "4.1.0.153",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "4.2.0",
              "lessThan": "4.2.0.105",
              "versionType": "custom",
              "status": "affected"
            },
            {
              "version": "4.3.0",
              "lessThan": "4.3.0.20",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-30T17:06:46.773782Z",
          "id": "CVE-2024-4989",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/wso2/product-apim/pull/13502",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    },
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3403/",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ]
}