{"schema":"threatline.record/2","record":{"id":"CVE-2024-5139","aliases":[],"summary":"Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection","details":"The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint.\n\nSuccessful exploitation allows an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract sensitive information from the browser. However, due to the `httpOnly` flag on session-related cookies, session hijacking is not possible.","categories":["Unclassified"],"product":"WSO2 Enterprise Integrator","vendor":"WSO2","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"6.6.0","versionType":"custom"},{"status":"affected","version":"6.6.0","lessThan":"6.6.0.204","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.310","versionType":"custom"},{"status":"affected","version":"6.0.0","lessThan":"6.0.0.212","versionType":"custom"},{"status":"affected","version":"6.1.0","lessThan":"6.1.0.195","versionType":"custom"},{"status":"affected","version":"7.0.0","lessThan":"7.0.0.64","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"3.1.0","versionType":"custom"},{"status":"affected","version":"3.1.0","lessThan":"3.1.0.286","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.376","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.10","versionType":"custom"},{"status":"affected","version":"4.0.0","lessThan":"4.0.0.299","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.159","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.91","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.6","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.336","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.306","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.357","versionType":"custom"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"WSO2 Carbon User Management UI","vendor":"WSO2","versions":[{"status":"affected","version":"5.14.127","lessThan":"5.14.127.6","versionType":"custom"},{"status":"affected","version":"5.17.5","lessThan":"5.17.5.273","versionType":"custom"},{"status":"affected","version":"5.17.118","lessThan":"5.17.118.3","versionType":"custom"},{"status":"affected","version":"5.18.187","lessThan":"5.18.187.260","versionType":"custom"},{"status":"affected","version":"5.18.248","lessThan":"5.18.248.12","versionType":"custom"},{"status":"affected","version":"5.23.8","lessThan":"5.23.8.191","versionType":"custom"},{"status":"affected","version":"5.24.8","lessThan":"5.24.8.3","versionType":"custom"},{"status":"affected","version":"5.25.92","lessThan":"5.25.92.99","versionType":"custom"},{"status":"affected","version":"5.25.705","lessThan":"5.25.705.3","versionType":"custom"},{"status":"affected","version":"7.0.78","lessThan":"7.0.78.43","versionType":"custom"}],"defaultStatus":"unknown"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Enterprise Integrator","ecosystem":null},"version":"6.6.0.204","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"5.10.0.310","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.0.0.212","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"6.1.0.195","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server","ecosystem":null},"version":"7.0.0.64","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.1.0.286","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.0.376","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"3.2.1.10","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.0.0.299","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.1.0.159","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.2.0.91","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 API Manager","ecosystem":null},"version":"4.3.0.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Open Banking AM","ecosystem":null},"version":"2.0.0.336","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Identity Server as Key Manager","ecosystem":null},"version":"5.10.0.306","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Open Banking IAM","ecosystem":null},"version":"2.0.0.357","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.14.127.6","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.17.5.273","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.17.118.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.18.187.260","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.18.248.12","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.23.8.191","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.24.8.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.25.92.99","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"5.25.705.3","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","source_modified_at":"2026-10-21T13:36:49.246Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"WSO2 Carbon User Management UI","ecosystem":null},"version":"7.0.78.43","basis":"first unaffected version stated in the CVE record"}],"cvss":6.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00227,"percentile":0.12712,"score_date":"2026-10-23"},"published_at":"2026-10-21T13:36:49.246Z","modified_at":"2026-10-21T13:36:49.246Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-5139","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-21T13:36:49.246Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-5139","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3382/","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/wso2/carbon-identity-framework/pull/5740","tags":["patch"]},{"source":"CVE List","url":"https://github.com/wso2/carbon-identity-framework/pull/5741","tags":["patch"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-21T13:36:49.246Z","content_hash":"06125b1e7ac28f27b2c4c4f7c529c053d1ee04b216283c95af3cb4e8a30f5a12"}}