{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-6423", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2024-07-01T08:23:45.912Z", "datePublished": "2026-10-21T13:56:26.552Z", "dateUpdated": "2026-10-30T15:11:58.008Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-10-21T13:59:54.562Z"}, "title": "Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-246", "descriptions": [{"lang": "en", "value": "CAPEC-246 CAPEC-246: Data Transmission"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.313", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.406", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.30", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.324", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.185", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.124", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.36", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.363", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.337", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.384", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.213", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.211", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.50", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.329", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.381", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Application", "packageName": "org.wso2.carbon.identity.application.authenticator.basicauth", "versions": [{"status": "affected", "version": "6.3.0", "lessThan": "6.3.0.18", "versionType": "custom"}, {"status": "affected", "version": "6.3.11", "lessThan": "6.3.11.23", "versionType": "custom"}, {"status": "affected", "version": "6.3.58", "lessThan": "6.3.58.1", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "lessThan": "6.5.0.5", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.1", "versionType": "custom"}, {"status": "affected", "version": "6.7.8", "lessThan": "6.7.8.4", "versionType": "custom"}, {"status": "affected", "version": "6.7.32", "lessThan": "6.7.32.1", "versionType": "custom"}, {"status": "unaffected", "version": "x", "lessThanOrEqual": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Core", "packageName": "org.wso2.carbon.identity.core", "versions": [{"status": "affected", "version": "5.17.5", "lessThan": "5.17.5.286", "versionType": "custom"}, {"status": "affected", "version": "5.17.118", "lessThan": "5.17.118.11", "versionType": "custom"}, {"status": "affected", "version": "5.18.187", "lessThan": "5.18.187.263", "versionType": "custom"}, {"status": "affected", "version": "5.18.248", "lessThan": "5.18.248.23", "versionType": "custom"}, {"status": "affected", "version": "5.23.8", "lessThan": "5.23.8.189", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.12", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.91", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.118", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.11", "versionType": "custom"}, {"status": "affected", "version": "5.25.713", "lessThan": "5.25.713.2", "versionType": "custom"}, {"status": "affected", "version": "7.0.78", "lessThan": "7.0.78.27", "versionType": "custom"}, {"status": "unaffected", "version": "x", "lessThanOrEqual": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Oauth", "packageName": "org.wso2.carbon.identity.oauth.common", "versions": [{"status": "affected", "version": "6.4.2", "lessThan": "6.4.2.142", "versionType": "custom"}, {"status": "affected", "version": "6.4.176", "lessThan": "6.4.176.20", "versionType": "custom"}, {"status": "affected", "version": "6.4.180", "lessThan": "6.4.180.8", "versionType": "custom"}, {"status": "affected", "version": "6.8.0", "lessThan": "6.8.0.40", "versionType": "custom"}, {"status": "affected", "version": "6.9.6", "lessThan": "6.9.6.16", "versionType": "custom"}, {"status": "affected", "version": "6.11.21", "lessThan": "6.11.21.44", "versionType": "custom"}, {"status": "affected", "version": "6.13.16", "lessThan": "6.13.16.6", "versionType": "custom"}, {"status": "affected", "version": "6.13.19", "lessThan": "6.13.19.2", "versionType": "custom"}, {"status": "affected", "version": "7.0.26", "lessThan": "7.0.26.18", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1.0", "versionEndExcluding": "3.1.0.313"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.0", "versionEndExcluding": "3.2.0.406"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.1", "versionEndExcluding": "3.2.1.30"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.0.0.324"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "4.1.0.185"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2.0", "versionEndExcluding": "4.2.0.124"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "4.3.0.36"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.0", "versionEndExcluding": "4.4.0.2"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.0.0.363"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.0", "versionEndExcluding": "5.10.0.337"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.0", "versionEndExcluding": "5.11.0.384"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.0.213"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.0.211"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.0.50"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.0", "versionEndExcluding": "5.10.0.329"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.0.0.381"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.0", "versionEndExcluding": "6.3.0.18"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.11", "versionEndExcluding": "6.3.11.23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3.58", "versionEndExcluding": "6.3.58.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.0", "versionEndExcluding": "6.5.0.5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.0", "versionEndExcluding": "6.6.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.8", "versionEndExcluding": "6.7.8.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.32", "versionEndExcluding": "6.7.32.1"}, {"vulnerable": false, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "versionStartIncluding": "x", "versionEndIncluding": "*"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.5", "versionEndExcluding": "5.17.5.286"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.118", "versionEndExcluding": "5.17.118.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.187", "versionEndExcluding": "5.18.187.263"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.248", "versionEndExcluding": "5.18.248.23"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.23.8", "versionEndExcluding": "5.23.8.189"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.24.8", "versionEndExcluding": "5.24.8.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.92", "versionEndExcluding": "5.25.92.91"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.92", "versionEndExcluding": "5.25.92.118"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.705", "versionEndExcluding": "5.25.705.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.713", "versionEndExcluding": "5.25.713.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.78", "versionEndExcluding": "7.0.78.27"}, {"vulnerable": false, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "versionStartIncluding": "x", "versionEndIncluding": "*"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.2", "versionEndExcluding": "6.4.2.142"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.176", "versionEndExcluding": "6.4.176.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.180", "versionEndExcluding": "6.4.180.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8.0", "versionEndExcluding": "6.8.0.40"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9.6", "versionEndExcluding": "6.9.6.16"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.11.21", "versionEndExcluding": "6.11.21.44"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.16", "versionEndExcluding": "6.13.16.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13.19", "versionEndExcluding": "6.13.19.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.26", "versionEndExcluding": "7.0.26.18"}]}]}], "descriptions": [{"lang": "en", "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2024-3465", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T15:11:01.346786Z", "id": "CVE-2024-6423", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:11:58.008Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6423", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T15:11:01.346786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T15:11:37.895Z"}}], "cna": {"title": "Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage", "source": {"advisory": "WSO2-2024-3465", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-246", "descriptions": [{"lang": "en", "value": "CAPEC-246 CAPEC-246: Data Transmission"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.313", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.406", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.30", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.324", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.185", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.124", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.36", "versionType": "custom"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.0.2", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.363", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.337", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.384", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.213", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.211", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.50", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.329", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.381", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Application", "versions": [{"status": "affected", "version": "6.3.0", "lessThan": "6.3.0.18", "versionType": "custom"}, {"status": "affected", "version": "6.3.11", "lessThan": "6.3.11.23", "versionType": "custom"}, {"status": "affected", "version": "6.3.58", "lessThan": "6.3.58.1", "versionType": "custom"}, {"status": "affected", "version": "6.5.0", "lessThan": "6.5.0.5", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.1", "versionType": "custom"}, {"status": "affected", "version": "6.7.8", "lessThan": "6.7.8.4", "versionType": "custom"}, {"status": "affected", "version": "6.7.32", "lessThan": "6.7.32.1", "versionType": "custom"}, {"status": "unaffected", "version": "x", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.application.authenticator.basicauth", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Core", "versions": [{"status": "affected", "version": "5.17.5", "lessThan": "5.17.5.286", "versionType": "custom"}, {"status": "affected", "version": "5.17.118", "lessThan": "5.17.118.11", "versionType": "custom"}, {"status": "affected", "version": "5.18.187", "lessThan": "5.18.187.263", "versionType": "custom"}, {"status": "affected", "version": "5.18.248", "lessThan": "5.18.248.23", "versionType": "custom"}, {"status": "affected", "version": "5.23.8", "lessThan": "5.23.8.189", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.12", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.91", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.118", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.11", "versionType": "custom"}, {"status": "affected", "version": "5.25.713", "lessThan": "5.25.713.2", "versionType": "custom"}, {"status": "affected", "version": "7.0.78", "lessThan": "7.0.78.27", "versionType": "custom"}, {"status": "unaffected", "version": "x", "versionType": "custom", "lessThanOrEqual": "*"}], "packageName": "org.wso2.carbon.identity.core", "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Oauth", "versions": [{"status": "affected", "version": "6.4.2", "lessThan": "6.4.2.142", "versionType": "custom"}, {"status": "affected", "version": "6.4.176", "lessThan": "6.4.176.20", "versionType": "custom"}, {"status": "affected", "version": "6.4.180", "lessThan": "6.4.180.8", "versionType": "custom"}, {"status": "affected", "version": "6.8.0", "lessThan": "6.8.0.40", "versionType": "custom"}, {"status": "affected", "version": "6.9.6", "lessThan": "6.9.6.16", "versionType": "custom"}, {"status": "affected", "version": "6.11.21", "lessThan": "6.11.21.44", "versionType": "custom"}, {"status": "affected", "version": "6.13.16", "lessThan": "6.13.16.6", "versionType": "custom"}, {"status": "affected", "version": "6.13.19", "lessThan": "6.13.19.2", "versionType": "custom"}, {"status": "affected", "version": "7.0.26", "lessThan": "7.0.26.18", "versionType": "custom"}], "packageName": "org.wso2.carbon.identity.oauth.common", "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution</span></a> <br>", "base64": false}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.", "supportingMedia": [{"type": "text/html", "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.1.0.313", "versionStartIncluding": "3.1.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.2.0.406", "versionStartIncluding": "3.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.2.1.30", "versionStartIncluding": "3.2.1"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.0.0.324", "versionStartIncluding": "4.0.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.1.0.185", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.2.0.124", "versionStartIncluding": "4.2.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.3.0.36", "versionStartIncluding": "4.3.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "4.4.0.2", "versionStartIncluding": "4.4.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.0.363", "versionStartIncluding": "2.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.0.337", "versionStartIncluding": "5.10.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.11.0.384", "versionStartIncluding": "5.11.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.0.213", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.0.211", "versionStartIncluding": "6.1.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.0.50", "versionStartIncluding": "7.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.0.329", "versionStartIncluding": "5.10.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.0.0.381", "versionStartIncluding": "2.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3.0.18", "versionStartIncluding": "6.3.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3.11.23", "versionStartIncluding": "6.3.11"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.3.58.1", "versionStartIncluding": "6.3.58"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.5.0.5", "versionStartIncluding": "6.5.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.0.1", "versionStartIncluding": "6.6.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.8.4", "versionStartIncluding": "6.7.8"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.32.1", "versionStartIncluding": "6.7.32"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*", "vulnerable": false, "versionEndIncluding": "*", "versionStartIncluding": "x"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17.5.286", "versionStartIncluding": "5.17.5"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17.118.11", "versionStartIncluding": "5.17.118"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.18.187.263", "versionStartIncluding": "5.18.187"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.18.248.23", "versionStartIncluding": "5.18.248"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.23.8.189", "versionStartIncluding": "5.23.8"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.24.8.12", "versionStartIncluding": "5.24.8"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.25.92.91", "versionStartIncluding": "5.25.92"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.25.92.118", "versionStartIncluding": "5.25.92"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.25.705.11", "versionStartIncluding": "5.25.705"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.25.713.2", "versionStartIncluding": "5.25.713"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.78.27", "versionStartIncluding": "7.0.78"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*", "vulnerable": false, "versionEndIncluding": "*", "versionStartIncluding": "x"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.4.2.142", "versionStartIncluding": "6.4.2"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.4.176.20", "versionStartIncluding": "6.4.176"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.4.180.8", "versionStartIncluding": "6.4.180"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8.0.40", "versionStartIncluding": "6.8.0"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.9.6.16", "versionStartIncluding": "6.9.6"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.21.44", "versionStartIncluding": "6.11.21"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.16.6", "versionStartIncluding": "6.13.16"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.19.2", "versionStartIncluding": "6.13.19"}, {"criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.26.18", "versionStartIncluding": "7.0.26"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-10-21T13:59:54.562Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6423", "state": "PUBLISHED", "dateUpdated": "2026-10-30T15:11:58.008Z", "dateReserved": "2024-07-01T08:23:45.912Z", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "datePublished": "2026-10-21T13:56:26.552Z", "assignerShortName": "WSO2"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "3.1.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "3.1.0.313", "status": "affected", "version": "3.1.0", "versionType": "custom"}, {"lessThan": "3.2.0.406", "status": "affected", "version": "3.2.0", "versionType": "custom"}, {"lessThan": "3.2.1.30", "status": "affected", "version": "3.2.1", "versionType": "custom"}, {"lessThan": "4.0.0.324", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "4.1.0.185", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.2.0.124", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.3.0.36", "status": "affected", "version": "4.3.0", "versionType": "custom"}, {"lessThan": "4.4.0.2", "status": "affected", "version": "4.4.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking AM", "vendor": "WSO2", "versions": [{"lessThan": "2.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.0.0.363", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.10.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.10.0.337", "status": "affected", "version": "5.10.0", "versionType": "custom"}, {"lessThan": "5.11.0.384", "status": "affected", "version": "5.11.0", "versionType": "custom"}, {"lessThan": "6.0.0.213", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "6.1.0.211", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "7.0.0.50", "status": "affected", "version": "7.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server as Key Manager", "vendor": "WSO2", "versions": [{"lessThan": "5.10.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.10.0.329", "status": "affected", "version": "5.10.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking IAM", "vendor": "WSO2", "versions": [{"lessThan": "2.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.0.0.381", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.application.authenticator.basicauth", "product": "WSO2 Carbon Identity Application", "vendor": "WSO2", "versions": [{"lessThan": "6.3.0.18", "status": "affected", "version": "6.3.0", "versionType": "custom"}, {"lessThan": "6.3.11.23", "status": "affected", "version": "6.3.11", "versionType": "custom"}, {"lessThan": "6.3.58.1", "status": "affected", "version": "6.3.58", "versionType": "custom"}, {"lessThan": "6.5.0.5", "status": "affected", "version": "6.5.0", "versionType": "custom"}, {"lessThan": "6.6.0.1", "status": "affected", "version": "6.6.0", "versionType": "custom"}, {"lessThan": "6.7.8.4", "status": "affected", "version": "6.7.8", "versionType": "custom"}, {"lessThan": "6.7.32.1", "status": "affected", "version": "6.7.32", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "x", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.core", "product": "WSO2 Carbon Identity Core", "vendor": "WSO2", "versions": [{"lessThan": "5.17.5.286", "status": "affected", "version": "5.17.5", "versionType": "custom"}, {"lessThan": "5.17.118.11", "status": "affected", "version": "5.17.118", "versionType": "custom"}, {"lessThan": "5.18.187.263", "status": "affected", "version": "5.18.187", "versionType": "custom"}, {"lessThan": "5.18.248.23", "status": "affected", "version": "5.18.248", "versionType": "custom"}, {"lessThan": "5.23.8.189", "status": "affected", "version": "5.23.8", "versionType": "custom"}, {"lessThan": "5.24.8.12", "status": "affected", "version": "5.24.8", "versionType": "custom"}, {"lessThan": "5.25.92.91", "status": "affected", "version": "5.25.92", "versionType": "custom"}, {"lessThan": "5.25.92.118", "status": "affected", "version": "5.25.92", "versionType": "custom"}, {"lessThan": "5.25.705.11", "status": "affected", "version": "5.25.705", "versionType": "custom"}, {"lessThan": "5.25.713.2", "status": "affected", "version": "5.25.713", "versionType": "custom"}, {"lessThan": "7.0.78.27", "status": "affected", "version": "7.0.78", "versionType": "custom"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "x", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.oauth.common", "product": "WSO2 Carbon Identity Oauth", "vendor": "WSO2", "versions": [{"lessThan": "6.4.2.142", "status": "affected", "version": "6.4.2", "versionType": "custom"}, {"lessThan": "6.4.176.20", "status": "affected", "version": "6.4.176", "versionType": "custom"}, {"lessThan": "6.4.180.8", "status": "affected", "version": "6.4.180", "versionType": "custom"}, {"lessThan": "6.8.0.40", "status": "affected", "version": "6.8.0", "versionType": "custom"}, {"lessThan": "6.9.6.16", "status": "affected", "version": "6.9.6", "versionType": "custom"}, {"lessThan": "6.11.21.44", "status": "affected", "version": "6.11.21", "versionType": "custom"}, {"lessThan": "6.13.16.6", "status": "affected", "version": "6.13.16", "versionType": "custom"}, {"lessThan": "6.13.19.2", "status": "affected", "version": "6.13.19", "versionType": "custom"}, {"lessThan": "7.0.26.18", "status": "affected", "version": "7.0.26", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."}, {"lang": "es", "value": "El producto no aplic\u00f3 las restricciones de validaci\u00f3n sobre la entrada suministrada por el usuario en los par\u00e1metros de la URL, lo que permite que datos sensibles se transmitan a flujos donde no se pretend\u00eda procesarlos. Aunque el producto no utiliz\u00f3 dichos datos, su aceptaci\u00f3n podr\u00eda generar su registro en los logs.\\n\\nSi un usuario env\u00eda por error datos sensibles mediante los par\u00e1metros de la URL a cualquier flujo, esos datos podr\u00edan registrarse inadvertidamente en los registros de acceso. Esto podr\u00eda exponer informaci\u00f3n confidencial, comprometiendo la seguridad y la privacidad de los sistemas afectados si el producto se utiliza de forma incorrecta."}], "id": "CVE-2024-6423", "lastModified": "2026-10-30T16:17:31.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.3, "impactScore": 3.6, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-6423", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T15:11:01.346786Z", "version": "2.0.3"}}]}, "published": "2026-10-21T14:17:05.660", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}