The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Wso2
  • Wso2 Api Manager
  • Wso2 Carbon Registry Kernel
  • Wso2 Enterprise Integrator
  • Wso2 Identity Server
  • Wso2 Identity Server As Key Manager
  • Wso2 Open Banking Am
  • Wso2 Open Banking Iam

No data.

No data.

References
Link Providers
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/ cve-icon cve-icon
History

Mon, 02 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 11:15:00 +0000

Type Values Removed Values Added
Description The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
Title Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks
First Time appeared Wso2
Wso2 wso2 Api Manager
Wso2 wso2 Carbon Registry Kernel
Wso2 wso2 Enterprise Integrator
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Am
Wso2 wso2 Open Banking Iam
Weaknesses CWE-601
CPEs cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_carbon_registry_kernel:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*
cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*
Vendors & Products Wso2
Wso2 wso2 Api Manager
Wso2 wso2 Carbon Registry Kernel
Wso2 wso2 Enterprise Integrator
Wso2 wso2 Identity Server
Wso2 wso2 Identity Server As Key Manager
Wso2 wso2 Open Banking Am
Wso2 wso2 Open Banking Iam
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: WSO2

Published: 2026-11-02T11:00:23.105Z

Updated: 2026-11-02T16:57:01.300Z

Reserved: 2024-03-11T13:20:39.998Z

Link: CVE-2024-2372

cve-icon Vulnrichment

Updated: 2026-11-02T16:56:56.799Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-02T11:17:28.460

Modified: 2026-11-02T17:17:30.520

Link: CVE-2024-2372

cve-icon Redhat

No data.