CVE-2024-4989

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/wso2/product-apim/pull/13502
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3403/

Configurations

No configuration.

History

27 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El parámetro de URL de callback en WSO2 API Manager no valida la entrada proporcionada por el usuario, lo que permite que sea controlado por actores maliciosos. La explotación de esta vulnerabilidad podría llevar a que los usuarios sean redirigidos a páginas web controladas por el atacante. Esto puede usarse en conjunto con técnicas de ingeniería social para engañar a los usuarios para que interactúen con enlaces maliciosos, lo que podría resultar en ataques de phishing destinados a adquirir información sensible o causar otros daños.

21 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 14:17

Updated : 2026-10-30 17:17

NVD link : CVE-2024-4989

Mitre link : CVE-2024-4989

CVE.ORG link : CVE-2024-4989

JSON object : View

Products Affected

No product.

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2024-4989", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-4989", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T17:06:46.773782Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "4.1.0", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.153", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.105", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.20", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-21T14:17:04.010", "references": [{"url": "https://github.com/wso2/product-apim/pull/13502", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}, {"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3403/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors.\n\nExploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm."}, {"lang": "es", "value": "El par\u00e1metro de URL de callback en WSO2 API Manager no valida la entrada proporcionada por el usuario, lo que permite que sea controlado por actores maliciosos.\n\nLa explotaci\u00f3n de esta vulnerabilidad podr\u00eda llevar a que los usuarios sean redirigidos a p\u00e1ginas web controladas por el atacante. Esto puede usarse en conjunto con t\u00e9cnicas de ingenier\u00eda social para enga\u00f1ar a los usuarios para que interact\u00faen con enlaces maliciosos, lo que podr\u00eda resultar en ataques de phishing destinados a adquirir informaci\u00f3n sensible o causar otros da\u00f1os."}], "lastModified": "2026-10-30T17:17:09.350", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}