CVE-2024-4989: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in WSO2 WSO2 API Manager

The vulnerability CVE-2024-4989 in WSO2 API Manager arises from improper validation of the callback URL parameter, enabling an attacker to control redirection destinations. This open redirect (CWE-601) can be exploited to redirect users to attacker-controlled websites, often used in social engineering or phishing campaigns. The affected versions are >=4.1.0 <4.1.0.153, >=4.2.0 <4.2.0.105, and >=4.3.0 <4.3.0.20. No known exploits are reported in the wild. The CVSS 3.1 base score is 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N), reflecting a medium impact primarily on confidentiality and integrity via user interaction.

Successful exploitation can lead to users being redirected to malicious websites controlled by attackers. This can facilitate phishing attacks aimed at stealing sensitive information or causing other harm. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction (UI:R) and network attack vector (AV:N).

A fix is available in versions 4.1.0.153, 4.2.0.105, and 4.3.0.20 and later. Users should upgrade WSO2 API Manager to these or newer versions to remediate the vulnerability. No vendor advisory was provided explicitly, but the presence of fixed versions indicates an official fix. Until upgrading, users should be cautious with URLs involving the callback parameter and educate users about the risk of phishing via manipulated redirects.