Skip to main content
Threat Radar animated logo

CVE-2024-4412: CWE-94: Improper Control of Generation of Code ('Code Injection') in WSO2 WSO2 Enterprise Integrator

0
Low
VulnerabilityCVE-2024-4412cvecve-2024-4412cwe-94
Published: 10/19/2026 (10/19/2026, 16:59:05 UTC)
Source: CVE Database V5
Vendor/Project: WSO2
Product: WSO2 Enterprise Integrator

Description

CVE-2024-4412 is a low-severity vulnerability in WSO2 Enterprise Integrator that allows code injection via malicious Expression Language (EL) input. Exploitation requires administrator privileges and the impact is limited since EL usage is confined to certain read operations.

CVSS v3.1

Score 2.7low

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Affected software

WSO2

WSO2 Enterprise Integrator

Affected versions
>=6.6.0 <6.6.0.205

WSO2

WSO2 API Manager

Affected versions
>=3.1.0 <3.1.0.276>=3.2.0 <3.2.0.366>=3.2.1 <3.2.1.18>=4.0.0 <4.0.0.307>=4.1.0 <4.1.0.169>=4.2.0 <4.2.0.108>=4.3.0 <4.3.0.20

WSO2

WSO2 Open Banking IAM

Affected versions
>=2.0.0 <2.0.0.346

WSO2

WSO2 Identity Server

Affected versions
>=5.10.0 <5.10.0.297>=5.11.0 <5.11.0.337>=6.0.0 <6.0.0.189>=6.1.0 <6.1.0.149>=7.0.0 <7.0.0.15

WSO2

WSO2 Identity Server as Key Manager

Affected versions
>=5.10.0 <5.10.0.293

WSO2

WSO2 Open Banking AM

Affected versions
>=2.0.0 <2.0.0.326

WSO2

WSO2 Carbon Identity User Store Configuration UI

Affected versions
>=5.14.127 <5.14.127.8>=5.17.5 <5.17.5.266>=5.17.118 <5.17.118.6>=5.18.187 <5.18.187.253>=5.18.248 <5.18.248.20>=5.23.8 <5.23.8.178>=5.24.8 <5.24.8.9>=5.25.92 <5.25.92.81>=5.25.705 <5.25.705.8>=7.0.78 <7.0.78.12

WSO2

WSO2 Carbon Identity User Store Configuration

Affected versions
>=5.14.127 <5.14.127.8>=5.17.5 <5.17.5.266>=5.17.118 <5.17.118.6>=5.18.187 <5.18.187.253>=5.18.248 <5.18.248.20>=5.23.8 <5.23.8.178>=5.24.8 <5.24.8.9>=5.25.92 <5.25.92.81>=5.25.705 <5.25.705.8>=7.0.78 <7.0.78.12

WSO2

WSO2 Carbon Identity Recovery Management

Affected versions
>=1.4.72 <1.4.72.66>=1.4.100 <1.4.100.6>=1.7.2 <1.7.2.2>=1.8.107 <1.8.107.1

WSO2

WSO2 Carbon Identity Application Authentication Framework

Affected versions
>=5.18.248 <5.18.248.20>=5.24.8 <5.24.8.9>=5.25.705 <5.25.705.8

WSO2

WSO2 Carbon Identity User Store

Affected versions
>=1.0.190 <1.0.190.14>=1.2.3 <1.2.3.4>=1.2.23 <1.2.23.4

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 10/19/2026, 17:18:56 UTC

Technical Analysis

This vulnerability arises from insufficient validation of user-supplied data in WSO2 Enterprise Integrator, permitting injection of malicious Expression Language (EL) code. Successful exploitation requires administrator privileges, limiting the attack surface. The vulnerability's impact is minimal because the EL code execution is restricted to certain read-only operations, reducing the potential for significant harm.

Potential Impact

An attacker with administrator privileges can inject malicious EL code, potentially causing arbitrary operations within the affected deployment. However, the impact is limited to low confidentiality impact with no integrity or availability impact, as EL usage is restricted to read operations only.

Mitigation Recommendations

No vendor advisory or patch links are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Given the requirement for administrator privileges and limited impact, ensure that administrator access is tightly controlled and monitor for any suspicious activity involving EL expressions.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
WSO2
Date Reserved
2024-05-02T08:55:58.638Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6ad64dbc2cdf04f656724f83

Added to database: 10/19/2026, 17:05:00 UTC

Last enriched: 10/19/2026, 17:18:56 UTC

Last updated: 10/19/2026, 19:06:46 UTC

Views: 10

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses