Skip to main content
Threat Radar animated logo

CVE-2024-6423: CWE-20: Improper Input Validation in WSO2 WSO2 API Manager

0
Medium
VulnerabilityCVE-2024-6423cvecve-2024-6423cwe-20gcveosvghsa-x7cg-x993-cw9wghsa
Published: 10/21/2026 (10/21/2026, 15:42:30 UTC)
Source: CVE Database V5
Vendor/Project: WSO2
Product: WSO2 API Manager

Description

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

CVSS v3.1

Score 4.0medium

Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Affected software

WSO2

WSO2 API Manager

Affected versions
>=3.1.0 <3.1.0.313>=3.2.0 <3.2.0.406>=3.2.1 <3.2.1.30>=4.0.0 <4.0.0.324>=4.1.0 <4.1.0.185>=4.2.0 <4.2.0.124>=4.3.0 <4.3.0.36>=4.4.0 <4.4.0.2

WSO2

WSO2 Open Banking AM

Affected versions
>=2.0.0 <2.0.0.363

WSO2

WSO2 Identity Server

Affected versions
>=5.10.0 <5.10.0.337>=5.11.0 <5.11.0.384>=6.0.0 <6.0.0.213>=6.1.0 <6.1.0.211>=7.0.0 <7.0.0.50

WSO2

WSO2 Identity Server as Key Manager

Affected versions
>=5.10.0 <5.10.0.329

WSO2

WSO2 Open Banking IAM

Affected versions
>=2.0.0 <2.0.0.381

WSO2

WSO2 Carbon Identity Application

Affected versions
>=6.3.0 <6.3.0.18>=6.3.11 <6.3.11.23>=6.3.58 <6.3.58.1>=6.5.0 <6.5.0.5>=6.6.0 <6.6.0.1>=6.7.8 <6.7.8.4>=6.7.32 <6.7.32.1

WSO2

WSO2 Carbon Identity Core

Affected versions
>=5.17.5 <5.17.5.286>=5.17.118 <5.17.118.11>=5.18.187 <5.18.187.263>=5.18.248 <5.18.248.23>=5.23.8 <5.23.8.189>=5.24.8 <5.24.8.12>=5.25.92 <5.25.92.91>=5.25.92 <5.25.92.118>=5.25.705 <5.25.705.11>=5.25.713 <5.25.713.2>=7.0.78 <7.0.78.27

WSO2

WSO2 Carbon Identity Oauth

Affected versions
>=6.4.2 <6.4.2.142>=6.4.176 <6.4.176.20>=6.4.180 <6.4.180.8>=6.8.0 <6.8.0.40>=6.9.6 <6.9.6.16>=6.11.21 <6.11.21.44>=6.13.16 <6.13.16.6>=6.13.19 <6.13.19.2>=7.0.26 <7.0.26.18

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 10/21/2026, 14:17:01 UTC

Technical Analysis

WSO2 API Manager versions prior to specific fixed builds fail to enforce validation constraints on user-supplied URL parameters. Although the product does not process this data, it accepts it and may log sensitive information inadvertently if such data is included in URL parameters. This improper input validation (CWE-20) can lead to exposure of confidential information through access logs if users mistakenly send sensitive data in URLs.

Potential Impact

The primary impact is potential exposure of sensitive information via access logs due to acceptance and logging of sensitive data in URL parameters. There is no indication of direct compromise or code execution. The confidentiality of data may be compromised if sensitive information is logged and accessed by unauthorized parties.

Mitigation Recommendations

A fix is available in specific patched versions of WSO2 API Manager as indicated by the affected version ranges. Users should upgrade to versions beyond the listed affected versions to remediate this issue. No additional mitigation is required if the product is used correctly without sending sensitive data in URL parameters.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
WSO2
Date Reserved
2024-07-01T08:23:45.912Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6ad8c5a24d27ba8daab0d959

Added to database: 10/21/2026, 14:01:06 UTC

Last enriched: 10/21/2026, 14:17:01 UTC

Last updated: 10/21/2026, 20:13:08 UTC

Views: 7

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses