CVE-2024-6541
Full vulnerability record from the local CVENow database.
Description
The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.
Severity
MEDIUM
CVSS score
6.8
(v3.1)
Vulnerability status
Deferred
Source identifier
ed10eef1-636d-4fbe-9993-6890dfa878f8
Published
2026-08-06 22:16:40.557000
Last modified
2026-10-27 18:10:00.130000
View original CVE JSON
{
"id": "CVE-2024-6541",
"sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"published": "2026-08-06T22:16:40.557",
"lastModified": "2026-10-27T18:10:00.130",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products."
},
{
"lang": "es",
"value": "El Class Mediator no valida o sanea correctamente las propiedades “messageContext” cuando se utilizan para poblar valores dinámicos. Esto permite a usuarios autenticados acceder o modificar potencialmente datos entre diferentes invocaciones del sistema que deberían estar aisladas.\n\nEsta debilidad puede llevar a la divulgación de información sensible perteneciente a otros usuarios o a la modificación no intencionada de datos del sistema por parte de usuarios autenticados. El impacto exacto depende de cómo se utilizan las propiedades “messageContext” dentro de los productos WSO2 afectados."
}
],
"affected": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"affectedData": [
{
"vendor": "WSO2",
"product": "WSO2 Micro Integrator",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "1.2.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "1.2.0",
"lessThan": "1.2.0.163",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.0.103",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.7",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 Enterprise Integrator",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "6.6.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "6.6.0",
"lessThan": "6.6.0.205",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0",
"lessThan": "3.2.0",
"versionType": "custom",
"status": "unknown"
},
{
"version": "3.2.0",
"lessThan": "3.2.0.394",
"versionType": "custom",
"status": "affected"
},
{
"version": "3.2.1",
"lessThan": "3.2.1.21",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0",
"lessThan": "4.0.0.311",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.1.0",
"lessThan": "4.1.0.167",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.2.0",
"lessThan": "4.2.0.110",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.3.0",
"lessThan": "4.3.0.24",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "WSO2",
"product": "WSO2-Synapse",
"defaultStatus": "unknown",
"packageName": "org.apache.synapse:synapse-core",
"versions": [
{
"version": "2.1.7.wso2v182",
"lessThan": "2.1.7.wso2v182_93",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.1.7.wso2v143",
"lessThan": "2.1.7.wso2v143_119",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.1.7.wso2v183",
"lessThan": "2.1.7.wso2v183_62",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.1.7.wso2v319",
"lessThan": "2.1.7.wso2v319_7",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.1.7.wso2v227",
"lessThan": "2.1.7.wso2v227_88",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.1.7.wso2v271",
"lessThan": "2.1.7.wso2v271_60",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0.wso2v119",
"lessThan": "4.0.0.wso2v119_3",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0.wso2v105",
"lessThan": "4.0.0.wso2v105_3",
"versionType": "custom",
"status": "affected"
},
{
"version": "4.0.0.wso2v20",
"lessThan": "4.0.0.wso2v20_63",
"versionType": "custom",
"status": "affected"
},
{
"version": "v4.0.0-wso2v121",
"lessThanOrEqual": "v4.0.0-wso2v*",
"versionType": "custom",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 1.6,
"impactScore": 5.2
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-07T17:45:31.638289Z",
"id": "CVE-2024-6541",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/",
"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}
]
}