CVE-2024-4412Published
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
cve-program · CVE-2024-4412
PublishedWSO2 Enterprise Integrator
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Enterprise Integrator",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "6.6.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.6.0",
"lessThan": "6.6.0.205",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 API Manager
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 API Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "3.1.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.1.0",
"lessThan": "3.1.0.276",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.0",
"lessThan": "3.2.0.366",
"versionType": "custom"
},
{
"status": "affected",
"version": "3.2.1",
"lessThan": "3.2.1.18",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.0.0",
"lessThan": "4.0.0.307",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.1.0",
"lessThan": "4.1.0.169",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.2.0",
"lessThan": "4.2.0.108",
"versionType": "custom"
},
{
"status": "affected",
"version": "4.3.0",
"lessThan": "4.3.0.20",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 Open Banking IAM
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Open Banking IAM",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.0.346",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 Identity Server
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Identity Server",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.297",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.11.0",
"lessThan": "5.11.0.337",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.0.0",
"lessThan": "6.0.0.189",
"versionType": "custom"
},
{
"status": "affected",
"version": "6.1.0",
"lessThan": "6.1.0.149",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.0",
"lessThan": "7.0.0.15",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 Identity Server as Key Manager
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Identity Server as Key Manager",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "5.10.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.10.0",
"lessThan": "5.10.0.293",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}WSO2 Open Banking AM
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Open Banking AM",
"versions": [
{
"status": "unknown",
"version": "0",
"lessThan": "2.0.0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.0.0.326",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity User Store Configuration UI",
"packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
"versions": [
{
"status": "affected",
"version": "5.14.127",
"lessThan": "5.14.127.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.17.5",
"lessThan": "5.17.5.266",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.17.118",
"lessThan": "5.17.118.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.18.187",
"lessThan": "5.18.187.253",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.18.248",
"lessThan": "5.18.248.20",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.23.8",
"lessThan": "5.23.8.178",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.24.8",
"lessThan": "5.24.8.9",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.92",
"lessThan": "5.25.92.81",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.705",
"lessThan": "5.25.705.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.78",
"lessThan": "7.0.78.12",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}org.wso2.carbon.identity.user.store.configuration
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity User Store Configuration",
"packageName": "org.wso2.carbon.identity.user.store.configuration",
"versions": [
{
"status": "affected",
"version": "5.14.127",
"lessThan": "5.14.127.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.17.5",
"lessThan": "5.17.5.266",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.17.118",
"lessThan": "5.17.118.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.18.187",
"lessThan": "5.18.187.253",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.18.248",
"lessThan": "5.18.248.20",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.23.8",
"lessThan": "5.23.8.178",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.24.8",
"lessThan": "5.24.8.9",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.92",
"lessThan": "5.25.92.81",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.705",
"lessThan": "5.25.705.8",
"versionType": "custom"
},
{
"status": "affected",
"version": "7.0.78",
"lessThan": "7.0.78.12",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Recovery Management",
"packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
"versions": [
{
"status": "affected",
"version": "1.4.72",
"lessThan": "1.4.72.66",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.4.100",
"lessThan": "1.4.100.6",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.7.2",
"lessThan": "1.7.2.2",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.8.107",
"lessThan": "1.8.107.1",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity Application Authentication Framework",
"packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
"versions": [
{
"status": "affected",
"version": "5.18.248",
"lessThan": "5.18.248.20",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.24.8",
"lessThan": "5.24.8.9",
"versionType": "custom"
},
{
"status": "affected",
"version": "5.25.705",
"lessThan": "5.25.705.8",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}org.wso2.carbon.identity.api.server.userstore.v1
Vendor product
Original vendor version evidence · not evaluated as a NuGet range
{
"vendor": "WSO2",
"product": "WSO2 Carbon Identity User Store",
"packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
"versions": [
{
"status": "affected",
"version": "1.0.190",
"lessThan": "1.0.190.14",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.2.3",
"lessThan": "1.2.3.4",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.2.23",
"lessThan": "1.2.23.4",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}Original source record · Cite this exact observation · Complete original publisher JSON