{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2024-6423",
"assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"state": "PUBLISHED",
"assignerShortName": "WSO2",
"dateReserved": "2024-07-01T08:23:45.912Z",
"datePublished": "2026-10-21T13:56:26.552Z",
"dateUpdated": "2026-10-21T13:59:54.562Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
"shortName": "WSO2",
"dateUpdated": "2026-10-21T13:59:54.562Z"
},
"title": "Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"type": "CWE"
}
]
}
],
"impacts": [
{
"capecId": "CAPEC-246",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-246 CAPEC-246: Data Transmission"
}
]
}
],
"affected": [
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "3.1.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.1.0",
"lessThan": "3.1.0.313",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.0.406",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.1",
"lessThan": "3.2.1.30",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.0.0",
"lessThan": "4.0.0.324",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.1.0",
"lessThan": "4.1.0.185",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.2.0",
"lessThan": "4.2.0.124",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.3.0",
"lessThan": "4.3.0.36",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.4.0",
"lessThan": "4.4.0.2",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Open Banking AM",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.0.363",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.337",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.11.0",
"lessThan": "5.11.0.384",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.0.0",
"lessThan": "6.0.0.213",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.1.0",
"lessThan": "6.1.0.211",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.0.0.50",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Identity Server as Key Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.329",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Open Banking IAM",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.0.381",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Application",
"packageName": "org.wso2.carbon.identity.application.authenticator.basicauth",
"versions": [
{
"status": "affected",
"version": "6.3.0",
"lessThan": "6.3.0.18",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.3.11",
"lessThan": "6.3.11.23",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.3.58",
"lessThan": "6.3.58.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.5.0",
"lessThan": "6.5.0.5",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.6.0",
"lessThan": "6.6.0.1",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.7.8",
"lessThan": "6.7.8.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.7.32",
"lessThan": "6.7.32.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x",
"lessThanOrEqual": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Core",
"packageName": "org.wso2.carbon.identity.core",
"versions": [
{
"status": "affected",
"version": "5.17.5",
"lessThan": "5.17.5.286",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.17.118",
"lessThan": "5.17.118.11",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.18.187",
"lessThan": "5.18.187.263",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.18.248",
"lessThan": "5.18.248.23",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.23.8",
"lessThan": "5.23.8.189",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.24.8",
"lessThan": "5.24.8.12",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.92",
"lessThan": "5.25.92.91",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.92",
"lessThan": "5.25.92.118",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.705",
"lessThan": "5.25.705.11",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.713",
"lessThan": "5.25.713.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.78",
"lessThan": "7.0.78.27",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "x",
"lessThanOrEqual": "*",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Oauth",
"packageName": "org.wso2.carbon.identity.oauth.common",
"versions": [
{
"status": "affected",
"version": "6.4.2",
"lessThan": "6.4.2.142",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.4.176",
"lessThan": "6.4.176.20",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.4.180",
"lessThan": "6.4.180.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.8.0",
"lessThan": "6.8.0.40",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.9.6",
"lessThan": "6.9.6.16",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.11.21",
"lessThan": "6.11.21.44",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.13.16",
"lessThan": "6.13.16.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.13.19",
"lessThan": "6.13.19.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.26",
"lessThan": "7.0.26.18",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
],
"cpeApplicability": [
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.1.0",
"versionEndExcluding": "3.1.0.313"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.0",
"versionEndExcluding": "3.2.0.406"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.2.1",
"versionEndExcluding": "3.2.1.30"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.0.0",
"versionEndExcluding": "4.0.0.324"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.1.0",
"versionEndExcluding": "4.1.0.185"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.2.0",
"versionEndExcluding": "4.2.0.124"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.3.0",
"versionEndExcluding": "4.3.0.36"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.0",
"versionEndExcluding": "4.4.0.2"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.0.0.363"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.0",
"versionEndExcluding": "5.10.0.337"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.0",
"versionEndExcluding": "5.11.0.384"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.0",
"versionEndExcluding": "6.0.0.213"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.0",
"versionEndExcluding": "6.1.0.211"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.0",
"versionEndExcluding": "7.0.0.50"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.0",
"versionEndExcluding": "5.10.0.329"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.0.0.381"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.0",
"versionEndExcluding": "6.3.0.18"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.11",
"versionEndExcluding": "6.3.11.23"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.58",
"versionEndExcluding": "6.3.58.1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.5.0",
"versionEndExcluding": "6.5.0.5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.0",
"versionEndExcluding": "6.6.0.1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.8",
"versionEndExcluding": "6.7.8.4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7.32",
"versionEndExcluding": "6.7.32.1"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*",
"versionStartIncluding": "x",
"versionEndIncluding": "*"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.5",
"versionEndExcluding": "5.17.5.286"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.118",
"versionEndExcluding": "5.17.118.11"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.187",
"versionEndExcluding": "5.18.187.263"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.248",
"versionEndExcluding": "5.18.248.23"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.23.8",
"versionEndExcluding": "5.23.8.189"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.24.8",
"versionEndExcluding": "5.24.8.12"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.25.92",
"versionEndExcluding": "5.25.92.91"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.25.92",
"versionEndExcluding": "5.25.92.118"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.25.705",
"versionEndExcluding": "5.25.705.11"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.25.713",
"versionEndExcluding": "5.25.713.2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.78",
"versionEndExcluding": "7.0.78.27"
},
{
"vulnerable": false,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*",
"versionStartIncluding": "x",
"versionEndIncluding": "*"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.2",
"versionEndExcluding": "6.4.2.142"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.176",
"versionEndExcluding": "6.4.176.20"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.4.180",
"versionEndExcluding": "6.4.180.8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.8.0",
"versionEndExcluding": "6.8.0.40"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.6",
"versionEndExcluding": "6.9.6.16"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.11.21",
"versionEndExcluding": "6.11.21.44"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.16",
"versionEndExcluding": "6.13.16.6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.19",
"versionEndExcluding": "6.13.19.2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0.26",
"versionEndExcluding": "7.0.26.18"
}
]
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."
}
]
}
],
"references": [
{
"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/",
"tags": [
"vendor-advisory"
]
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 4,
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"
}
}
],
"solutions": [
{
"lang": "en",
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution
"
}
]
}
],
"source": {
"advisory": "WSO2-2024-3465",
"discovery": "INTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
}
}