CVE-2024-4412: wso2 wso2 api manager Code Injection

CVSS: 2.7v3.1LowAwaiting analysis

Published 19-10-2026Last modified 19-10-2026

Open JSON

Vulnerability summary

CVE-2024-4412 is a low (CVSS 2.7) Code Injection vulnerability in wso2 wso2 api manager.

Overall risk

11/100

0100

Low · default modelHow is this calculated?

CVSS score

2.7/10

010

Low · v3.1 (CVE.org)

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

19-10-2026
PublishedVulnerability first disclosed.

Description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

CVSS metrics

2 scores · 2 sources · 1 version

v3.12.7

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected systems

Wso211 products

wso2 api manager≥ 3.1.0, < 3.1.0.276 | ≥ 3.2.0, < 3.2.0.366 | ≥ 3.2.1, < 3.2.1.18 | ≥ 4.0.0, < 4.0.0.307 | ≥ 4.1.0, < 4.1.0.169 | ≥ 4.2.0, < 4.2.0.108 | ≥ 4.3.0, < 4.3.0.20
wso2 carbon identity application authentication framework≥ 5.18.248, < 5.18.248.20 | ≥ 5.24.8, < 5.24.8.9 | ≥ 5.25.705, < 5.25.705.8
wso2 carbon identity recovery management≥ 1.4.72, < 1.4.72.66 | ≥ 1.4.100, < 1.4.100.6 | ≥ 1.7.2, < 1.7.2.2 | ≥ 1.8.107, < 1.8.107.1
wso2 carbon identity user store≥ 1.0.190, < 1.0.190.14 | ≥ 1.2.3, < 1.2.3.4 | ≥ 1.2.23, < 1.2.23.4
wso2 carbon identity user store configuration≥ 5.14.127, < 5.14.127.8 | ≥ 5.17.5, < 5.17.5.266 | ≥ 5.17.118, < 5.17.118.6 | ≥ 5.18.187, < 5.18.187.253 | ≥ 5.18.248, < 5.18.248.20 | ≥ 5.23.8, < 5.23.8.178 | ≥ 5.24.8, < 5.24.8.9 | ≥ 5.25.92, < 5.25.92.81 | ≥ 5.25.705, < 5.25.705.8 | ≥ 7.0.78, < 7.0.78.12

Show all 11

1 vendor · 11 products

References

5 links