CVE-2024-12139

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/

Configurations

No configuration.

History

02 Nov 2026, 19:17

Type	Values Removed	Values Added
CWE		CWE-116

02 Nov 2026, 18:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-11-02 18:18

Updated : 2026-11-02 19:17

NVD link : CVE-2024-12139

Mitre link : CVE-2024-12139

CVE.ORG link : CVE-2024-12139

JSON object : View

Products Affected

No product.

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2024-12139", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-12139", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:09:36.270401Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.1", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.49", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.210", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.148", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.346", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.385", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.229", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.339", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-11-02T18:18:33.763", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.\n\nBy exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions."}], "lastModified": "2026-11-02T19:17:48.830", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}