CVE-2024-6541

The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/

Configurations

No configuration.

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) El Class Mediator no valida o sanea correctamente las propiedades “messageContext” cuando se utilizan para poblar valores dinámicos. Esto permite a usuarios autenticados acceder o modificar potencialmente datos entre diferentes invocaciones del sistema que deberían estar aisladas. Esta debilidad puede llevar a la divulgación de información sensible perteneciente a otros usuarios o a la modificación no intencionada de datos del sistema por parte de usuarios autenticados. El impacto exacto depende de cómo se utilizan las propiedades “messageContext” dentro de los productos WSO2 afectados.

Information

Published : 2026-08-06 22:16

Updated : 2026-10-27 18:10

NVD link : CVE-2024-6541

Mitre link : CVE-2024-6541

CVE.ORG link : CVE-2024-6541

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2024-6541", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6541", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-07T17:45:31.638289Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "affected": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "affectedData": [{"vendor": "WSO2", "product": "WSO2 Micro Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "1.2.0", "versionType": "custom"}, {"status": "affected", "version": "1.2.0", "lessThan": "1.2.0.163", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.103", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Enterprise Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "6.6.0", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.205", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.2.0", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.394", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.21", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.311", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.167", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.110", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.24", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2-Synapse", "versions": [{"status": "affected", "version": "2.1.7.wso2v182", "lessThan": "2.1.7.wso2v182_93", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v143", "lessThan": "2.1.7.wso2v143_119", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v183", "lessThan": "2.1.7.wso2v183_62", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v319", "lessThan": "2.1.7.wso2v319_7", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v227", "lessThan": "2.1.7.wso2v227_88", "versionType": "custom"}, {"status": "affected", "version": "2.1.7.wso2v271", "lessThan": "2.1.7.wso2v271_60", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v119", "lessThan": "4.0.0.wso2v119_3", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v105", "lessThan": "4.0.0.wso2v105_3", "versionType": "custom"}, {"status": "affected", "version": "4.0.0.wso2v20", "lessThan": "4.0.0.wso2v20_63", "versionType": "custom"}, {"status": "unaffected", "version": "v4.0.0-wso2v121", "versionType": "custom", "lessThanOrEqual": "v4.0.0-wso2v*"}], "packageName": "org.apache.synapse:synapse-core", "defaultStatus": "unknown"}]}], "published": "2026-08-06T22:16:40.557", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3520/", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.\n\nThis weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products."}, {"lang": "es", "value": "El Class Mediator no valida o sanea correctamente las propiedades \u201cmessageContext\u201d cuando se utilizan para poblar valores din\u00e1micos. Esto permite a usuarios autenticados acceder o modificar potencialmente datos entre diferentes invocaciones del sistema que deber\u00edan estar aisladas.\n\nEsta debilidad puede llevar a la divulgaci\u00f3n de informaci\u00f3n sensible perteneciente a otros usuarios o a la modificaci\u00f3n no intencionada de datos del sistema por parte de usuarios autenticados. El impacto exacto depende de c\u00f3mo se utilizan las propiedades \u201cmessageContext\u201d dentro de los productos WSO2 afectados."}], "lastModified": "2026-10-27T18:10:00.130", "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}