{"schema":"threatline.record/2","record":{"id":"CVE-2024-4412","aliases":[],"summary":"Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations","details":"The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.","categories":["Unclassified"],"product":"WSO2 Enterprise Integrator","vendor":"WSO2","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"6.6.0","versionType":"custom"},{"status":"affected","version":"6.6.0","lessThan":"6.6.0.205","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"3.1.0","versionType":"custom"},{"status":"affected","version":"3.1.0","lessThan":"3.1.0.276","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.366","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.18","versionType":"custom"},{"status":"affected","version":"4.0.0","lessThan":"4.0.0.307","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.169","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.108","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.20","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.346","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.297","versionType":"custom"},{"status":"affected","version":"5.11.0","lessThan":"5.11.0.337","versionType":"custom"},{"status":"affected","version":"6.0.0","lessThan":"6.0.0.189","versionType":"custom"},{"status":"affected","version":"6.1.0","lessThan":"6.1.0.149","versionType":"custom"},{"status":"affected","version":"7.0.0","lessThan":"7.0.0.15","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.293","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.326","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon Identity User Store Configuration UI","vendor":"WSO2","versions":[{"status":"affected","version":"5.14.127","lessThan":"5.14.127.8","versionType":"custom"},{"status":"affected","version":"5.17.5","lessThan":"5.17.5.266","versionType":"custom"},{"status":"affected","version":"5.17.118","lessThan":"5.17.118.6","versionType":"custom"},{"status":"affected","version":"5.18.187","lessThan":"5.18.187.253","versionType":"custom"},{"status":"affected","version":"5.18.248","lessThan":"5.18.248.20","versionType":"custom"},{"status":"affected","version":"5.23.8","lessThan":"5.23.8.178","versionType":"custom"},{"status":"affected","version":"5.24.8","lessThan":"5.24.8.9","versionType":"custom"},{"status":"affected","version":"5.25.92","lessThan":"5.25.92.81","versionType":"custom"},{"status":"affected","version":"5.25.705","lessThan":"5.25.705.8","versionType":"custom"},{"status":"affected","version":"7.0.78","lessThan":"7.0.78.12","versionType":"custom"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon Identity User Store Configuration","vendor":"WSO2","versions":[{"status":"affected","version":"5.14.127","lessThan":"5.14.127.8","versionType":"custom"},{"status":"affected","version":"5.17.5","lessThan":"5.17.5.266","versionType":"custom"},{"status":"affected","version":"5.17.118","lessThan":"5.17.118.6","versionType":"custom"},{"status":"affected","version":"5.18.187","lessThan":"5.18.187.253","versionType":"custom"},{"status":"affected","version":"5.18.248","lessThan":"5.18.248.20","versionType":"custom"},{"status":"affected","version":"5.23.8","lessThan":"5.23.8.178","versionType":"custom"},{"status":"affected","version":"5.24.8","lessThan":"5.24.8.9","versionType":"custom"},{"status":"affected","version":"5.25.92","lessThan":"5.25.92.81","versionType":"custom"},{"status":"affected","version":"5.25.705","lessThan":"5.25.705.8","versionType":"custom"},{"status":"affected","version":"7.0.78","lessThan":"7.0.78.12","versionType":"custom"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon Identity Recovery Management","vendor":"WSO2","versions":[{"status":"affected","version":"1.4.72","lessThan":"1.4.72.66","versionType":"custom"},{"status":"affected","version":"1.4.100","lessThan":"1.4.100.6","versionType":"custom"},{"status":"affected","version":"1.7.2","lessThan":"1.7.2.2","versionType":"custom"},{"status":"affected","version":"1.8.107","lessThan":"1.8.107.1","versionType":"custom"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon Identity Application Authentication Framework","vendor":"WSO2","versions":[{"status":"affected","version":"5.18.248","lessThan":"5.18.248.20","versionType":"custom"},{"status":"affected","version":"5.24.8","lessThan":"5.24.8.9","versionType":"custom"},{"status":"affected","version":"5.25.705","lessThan":"5.25.705.8","versionType":"custom"}],"defaultStatus":"unknown"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon Identity User Store","vendor":"WSO2","versions":[{"status":"affected","version":"1.0.190","lessThan":"1.0.190.14","versionType":"custom"},{"status":"affected","version":"1.2.3","lessThan":"1.2.3.4","versionType":"custom"},{"status":"affected","version":"1.2.23","lessThan":"1.2.23.4","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Enterprise Integrator","ecosystem":null},"version":"6.6.0.205","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.1.0.276","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.0.366","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.1.18","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.0.0.307","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.1.0.169","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.2.0.108","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.3.0.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Open Banking IAM","ecosystem":null},"version":"2.0.0.346","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.10.0.297","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.11.0.337","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.0.0.189","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.1.0.149","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.0.0.15","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server as Key Manager","ecosystem":null},"version":"5.10.0.293","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Open Banking AM","ecosystem":null},"version":"2.0.0.326","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.14.127.8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.17.5.266","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.17.118.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.18.187.253","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.18.248.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.23.8.178","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.24.8.9","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.25.92.81","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"5.25.705.8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration UI","ecosystem":null},"version":"7.0.78.12","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.14.127.8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.17.5.266","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.17.118.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.18.187.253","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.18.248.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.23.8.178","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.24.8.9","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.25.92.81","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"5.25.705.8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store Configuration","ecosystem":null},"version":"7.0.78.12","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity Recovery Management","ecosystem":null},"version":"1.4.72.66","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity Recovery Management","ecosystem":null},"version":"1.4.100.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity Recovery Management","ecosystem":null},"version":"1.7.2.2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity Recovery Management","ecosystem":null},"version":"1.8.107.1","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity Application Authentication Framework","ecosystem":null},"version":"5.18.248.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity Application Authentication Framework","ecosystem":null},"version":"5.24.8.9","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity Application Authentication Framework","ecosystem":null},"version":"5.25.705.8","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store","ecosystem":null},"version":"1.0.190.14","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store","ecosystem":null},"version":"1.2.3.4","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","source_modified_at":"2026-10-20T19:31:26.457Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon Identity User Store","ecosystem":null},"version":"1.2.23.4","basis":"first unaffected version stated in the CVE record"}],"cvss":2.7,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.0028,"percentile":0.19423,"score_date":"2026-10-23"},"published_at":"2026-10-19T16:59:05.004Z","modified_at":"2026-10-20T19:31:26.457Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-4412","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-20T19:31:26.457Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4412","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/wso2-extensions/identity-governance/pull/848","tags":["patch"]},{"source":"CVE List","url":"https://github.com/wso2/carbon-identity-framework/pull/5895","tags":["patch"]},{"source":"CVE List","url":"https://github.com/wso2/identity-apps/pull/6829","tags":["patch"]},{"source":"CVE List","url":"https://github.com/wso2/product-apim/pull/13524","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-20T19:31:18.482516Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-20T19:31:26.457Z","content_hash":"de836fe2f13344d350208819f5684c5d2aa192aa822b0eefecc5b0cc037f4430"}}