CVE-2024-6429
Full vulnerability record from the local CVENow database.
Description
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
Severity
MEDIUM
CVSS score
4.3
(v3.1)
Vulnerability status
Analyzed
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2025-09-23 17:15:30.643000
Last modified
2026-11-09 10:10:00.217000
View original CVE JSON
{
"id": "CVE-2024-6429",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2025-09-23T17:15:30.643",
"lastModified": "2026-11-09T10:10:00.217",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.\n\nBy exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content."
},
{
"lang": "es",
"value": "Una vulnerabilidad de suplantación de contenido existe en múltiples productos WSO2 debido a un manejo inadecuado de los mensajes de error. Bajo ciertas condiciones, los mensajes de error se pasan a través de parámetros de URL sin validación, permitiendo a actores maliciosos inyectar contenido arbitrario en la interfaz de usuario (UI).\n\nAl explotar esta vulnerabilidad, los atacantes pueden manipular los mensajes de error mostrados por el navegador, habilitando ataques de ingeniería social a través de contenido engañoso o equívoco."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 Identity Server as Key Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "5.10.0",
"lessThan": "5.10.0.338",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "3.2.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "3.2.0",
"lessThan": "3.2.0.409",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.1",
"lessThan": "3.2.1.33",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0",
"lessThan": "4.0.0.327",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.0.188",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.128",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.38",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.4.0",
"lessThan": "4.4.0.4",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "5.10.0",
"lessThan": "5.10.0.314",
"versionType": "custom",
"status": "affected"
},
{
"version": "5.11.0",
"lessThan": "5.11.0.359",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.0.0",
"lessThan": "6.0.0.203",
"versionType": "custom",
"status": "affected"
},
{
"version": "6.1.0",
"lessThan": "6.1.0.176",
"versionType": "custom",
"status": "affected"
},
{
"version": "7.0.0",
"lessThan": "7.0.0.48",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 1.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-23T18:31:05.120276Z",
"id": "CVE-2024-6429",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-451"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
"matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
"matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
"matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7B81C488-69D0-4A5C-AEED-31869C1BF5CA"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "65CD2558-C60C-4296-8E96-D4D804C598F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B8DF49C6-F2F6-4229-982E-0C0559265203"
}
]
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"tags": [
"Vendor Advisory"
]
}
]
}