CVE-2024-6423

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/

Configurations

No configuration.

History

27 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El producto no aplicó las restricciones de validación sobre la entrada suministrada por el usuario en los parámetros de la URL, lo que permite que datos sensibles se transmitan a flujos donde no se pretendía procesarlos. Aunque el producto no utilizó dichos datos, su aceptación podría generar su registro en los logs.\n\nSi un usuario envía por error datos sensibles mediante los parámetros de la URL a cualquier flujo, esos datos podrían registrarse inadvertidamente en los registros de acceso. Esto podría exponer información confidencial, comprometiendo la seguridad y la privacidad de los sistemas afectados si el producto se utiliza de forma incorrecta.

21 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 14:17

Updated : 2026-10-30 16:17

NVD link : CVE-2024-6423

Mitre link : CVE-2024-6423

CVE.ORG link : CVE-2024-6423

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2024-6423", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6423", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T15:11:01.346786Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.3}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.313", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.406", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.30", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.324", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.185", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.124", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.36", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.363", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.337", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.384", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.213", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.211", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.50", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.329", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.381", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Application", "versions": [{"status": "affected", "version": "6.3.0", "lessThan": "6.3.0.18", "versionType": "custom"}, {"status": "affected", "version": "6.3.11", "lessThan": "6.3.11.23", "versionType": "custom"}, {"status": "affected", "version": "6.3.58", "lessThan": "6.3.58.1", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "lessThan": "6.5.0.5", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.1", "versionType": "custom"}, {"status": "affected", "version": "6.7.8", "lessThan": "6.7.8.4", "versionType": "custom"}, {"status": "affected", "version": "6.7.32", "lessThan": "6.7.32.1", "versionType": "custom"}, {"status": "unaffected", "version": "x", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.application.authenticator.basicauth", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Core", "versions": [{"status": "affected", "version": "5.17.5", "lessThan": "5.17.5.286", "versionType": "custom"}, {"status": "affected", "version": "5.17.118", "lessThan": "5.17.118.11", "versionType": "custom"}, {"status": "affected", "version": "5.18.187", "lessThan": "5.18.187.263", "versionType": "custom"}, {"status": "affected", "version": "5.18.248", "lessThan": "5.18.248.23", "versionType": "custom"}, {"status": "affected", "version": "5.23.8", "lessThan": "5.23.8.189", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.12", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.91", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.118", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.11", "versionType": "custom"}, {"status": "affected", "version": "5.25.713", "lessThan": "5.25.713.2", "versionType": "custom"}, {"status": "affected", "version": "7.0.78", "lessThan": "7.0.78.27", "versionType": "custom"}, {"status": "unaffected", "version": "x", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.core", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Oauth", "versions": [{"status": "affected", "version": "6.4.2", "lessThan": "6.4.2.142", "versionType": "custom"}, {"status": "affected", "version": "6.4.176", "lessThan": "6.4.176.20", "versionType": "custom"}, {"status": "affected", "version": "6.4.180", "lessThan": "6.4.180.8", "versionType": "custom"}, {"status": "affected", "version": "6.8.0", "lessThan": "6.8.0.40", "versionType": "custom"}, {"status": "affected", "version": "6.9.6", "lessThan": "6.9.6.16", "versionType": "custom"}, {"status": "affected", "version": "6.11.21", "lessThan": "6.11.21.44", "versionType": "custom"}, {"status": "affected", "version": "6.13.16", "lessThan": "6.13.16.6", "versionType": "custom"}, {"status": "affected", "version": "6.13.19", "lessThan": "6.13.19.2", "versionType": "custom"}, {"status": "affected", "version": "7.0.26", "lessThan": "7.0.26.18", "versionType": "custom"}], "packageName": "org.wso2.carbon.identity.oauth.common", "defaultStatus": "unknown"}]}], "published": "2026-10-21T14:17:05.660", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."}, {"lang": "es", "value": "El producto no aplic\u00f3 las restricciones de validaci\u00f3n sobre la entrada suministrada por el usuario en los par\u00e1metros de la URL, lo que permite que datos sensibles se transmitan a flujos donde no se pretend\u00eda procesarlos. Aunque el producto no utiliz\u00f3 dichos datos, su aceptaci\u00f3n podr\u00eda generar su registro en los logs.\\n\\nSi un usuario env\u00eda por error datos sensibles mediante los par\u00e1metros de la URL a cualquier flujo, esos datos podr\u00edan registrarse inadvertidamente en los registros de acceso. Esto podr\u00eda exponer informaci\u00f3n confidencial, comprometiendo la seguridad y la privacidad de los sistemas afectados si el producto se utiliza de forma incorrecta."}], "lastModified": "2026-10-30T16:17:31.653", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}