CVE-2024-6423
Full vulnerability record from the local CVENow database.
Description
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
Severity
MEDIUM
CVSS score
4.0
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2026-10-21 14:17:05.660000
Last modified
2026-10-27 19:10:00.123000
View original CVE JSON
{
"id": "CVE-2024-6423",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2026-10-21T14:17:05.660",
"lastModified": "2026-10-27T19:10:00.123",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
},
{
"lang": "es",
"value": "El producto no aplicó las restricciones de validación sobre la entrada suministrada por el usuario en los parámetros de la URL, lo que permite que datos sensibles se transmitan a flujos donde no se pretendía procesarlos. Aunque el producto no utilizó dichos datos, su aceptación podría generar su registro en los logs.\\n\\nSi un usuario envía por error datos sensibles mediante los parámetros de la URL a cualquier flujo, esos datos podrían registrarse inadvertidamente en los registros de acceso. Esto podría exponer información confidencial, comprometiendo la seguridad y la privacidad de los sistemas afectados si el producto se utiliza de forma incorrecta."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "3.1.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "3.1.0",
"lessThan": "3.1.0.313",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.0",
"lessThan": "3.2.0.406",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.1",
"lessThan": "3.2.1.30",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0",
"lessThan": "4.0.0.324",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.0.185",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.124",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.36",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.0",
"lessThan": "4.4.0.2",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Open Banking AM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "2.0.0",
"lessThan": "2.0.0.363",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "5.10.0",
"lessThan": "5.10.0.337",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.11.0",
"lessThan": "5.11.0.384",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.0.0",
"lessThan": "6.0.0.213",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.1.0",
"lessThan": "6.1.0.211",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.0",
"lessThan": "7.0.0.50",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server as Key Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "5.10.0",
"lessThan": "5.10.0.329",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Open Banking IAM",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "2.0.0",
"lessThan": "2.0.0.381",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Application",
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.application.authenticator.basicauth",
"versions": [
{
"version": "6.3.0",
"lessThan": "6.3.0.18",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.3.11",
"lessThan": "6.3.11.23",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.3.58",
"lessThan": "6.3.58.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.5.0",
"lessThan": "6.5.0.5",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.6.0",
"lessThan": "6.6.0.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.7.8",
"lessThan": "6.7.8.4",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.7.32",
"lessThan": "6.7.32.1",
"versionType": "custom",
"status": "affected"
},
{
"version": "x",
"lessThanOrEqual": "*",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Core",
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.core",
"versions": [
{
"version": "5.17.5",
"lessThan": "5.17.5.286",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.17.118",
"lessThan": "5.17.118.11",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.18.187",
"lessThan": "5.18.187.263",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.18.248",
"lessThan": "5.18.248.23",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.23.8",
"lessThan": "5.23.8.189",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.24.8",
"lessThan": "5.24.8.12",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.25.92",
"lessThan": "5.25.92.91",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.25.92",
"lessThan": "5.25.92.118",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.25.705",
"lessThan": "5.25.705.11",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.25.713",
"lessThan": "5.25.713.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.78",
"lessThan": "7.0.78.27",
"versionType": "custom",
"status": "affected"
},
{
"version": "x",
"lessThanOrEqual": "*",
"versionType": "custom",
"status": "unaffected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Oauth",
"defaultStatus": "unknown",
"packageName": "org.wso2.carbon.identity.oauth.common",
"versions": [
{
"version": "6.4.2",
"lessThan": "6.4.2.142",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.4.176",
"lessThan": "6.4.176.20",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.4.180",
"lessThan": "6.4.180.8",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.8.0",
"lessThan": "6.8.0.40",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.9.6",
"lessThan": "6.9.6.16",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.11.21",
"lessThan": "6.11.21.44",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.13.16",
"lessThan": "6.13.16.6",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.13.19",
"lessThan": "6.13.19.2",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.26",
"lessThan": "7.0.26.18",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 0.3,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}
]
}