All vulnerabilities
CVE-2024-4412

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

WSO2 WSO2 Enterprise Integrator
Open in ThreatlineRecord JSON
CVSS
2.7Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.6.0.205Also 3.1.0.276, 3.2.0.366 and 30 moreCVE List
Published19 Oct 2026Updated 20 Oct 2026CVE List

What fixes it

Show all 46 fixed versions
  • 4.2.0.108WSO2 API ManagerCVE List
  • 4.3.0.20WSO2 API ManagerCVE List
  • 2.0.0.346WSO2 Open Banking IAMCVE List
  • 5.10.0.297WSO2 Identity ServerCVE List
  • 5.11.0.337WSO2 Identity ServerCVE List
  • 6.0.0.189WSO2 Identity ServerCVE List
  • 6.1.0.149WSO2 Identity ServerCVE List
  • 7.0.0.15WSO2 Identity ServerCVE List
  • 5.10.0.293WSO2 Identity Server as Key ManagerCVE List
  • 2.0.0.326WSO2 Open Banking AMCVE List
  • 5.14.127.8WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.17.5.266WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.17.118.6WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.18.187.253WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.18.248.20WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.23.8.178WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.24.8.9WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.25.92.81WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.25.705.8WSO2 Carbon Identity User Store Configuration UICVE List
  • 7.0.78.12WSO2 Carbon Identity User Store Configuration UICVE List
  • 5.14.127.8WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.17.5.266WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.17.118.6WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.18.187.253WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.18.248.20WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.23.8.178WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.24.8.9WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.25.92.81WSO2 Carbon Identity User Store ConfigurationCVE List
  • 5.25.705.8WSO2 Carbon Identity User Store ConfigurationCVE List
  • 7.0.78.12WSO2 Carbon Identity User Store ConfigurationCVE List
  • 1.4.72.66WSO2 Carbon Identity Recovery ManagementCVE List
  • 1.4.100.6WSO2 Carbon Identity Recovery ManagementCVE List
  • 1.7.2.2WSO2 Carbon Identity Recovery ManagementCVE List
  • 1.8.107.1WSO2 Carbon Identity Recovery ManagementCVE List
  • 5.18.248.20WSO2 Carbon Identity Application Authentication FrameworkCVE List
  • 5.24.8.9WSO2 Carbon Identity Application Authentication FrameworkCVE List
  • 5.25.705.8WSO2 Carbon Identity Application Authentication FrameworkCVE List
  • 1.0.190.14WSO2 Carbon Identity User StoreCVE List
  • 1.2.3.4WSO2 Carbon Identity User StoreCVE List
  • 1.2.23.4WSO2 Carbon Identity User StoreCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.

Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Text from CVE List

Affected versions 52

  • WSO2 Enterprise Integratorunknown: all versions before 6.6.0CVE List
  • WSO2 Enterprise Integratoraffected: 6.6.0 before 6.6.0.205CVE List
  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.276CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.366CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.18CVE List
  • WSO2 API Manageraffected: 4.0.0 before 4.0.0.307CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.169CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.108CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.20CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.346CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.297CVE List
  • WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.337CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.189CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.149CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.15CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.293CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.326CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.14.127 before 5.14.127.8CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.17.5 before 5.17.5.266CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.17.118 before 5.17.118.6CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.18.187 before 5.18.187.253CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.18.248 before 5.18.248.20CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.23.8 before 5.23.8.178CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.24.8 before 5.24.8.9CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.25.92 before 5.25.92.81CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 5.25.705 before 5.25.705.8CVE List
  • WSO2 Carbon Identity User Store Configuration UIaffected: 7.0.78 before 7.0.78.12CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.14.127 before 5.14.127.8CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.17.5 before 5.17.5.266CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.17.118 before 5.17.118.6CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.18.187 before 5.18.187.253CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.18.248 before 5.18.248.20CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.23.8 before 5.23.8.178CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.24.8 before 5.24.8.9CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.25.92 before 5.25.92.81CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 5.25.705 before 5.25.705.8CVE List
  • WSO2 Carbon Identity User Store Configurationaffected: 7.0.78 before 7.0.78.12CVE List
  • WSO2 Carbon Identity Recovery Managementaffected: 1.4.72 before 1.4.72.66CVE List
  • WSO2 Carbon Identity Recovery Managementaffected: 1.4.100 before 1.4.100.6CVE List
  • WSO2 Carbon Identity Recovery Managementaffected: 1.7.2 before 1.7.2.2CVE List
  • WSO2 Carbon Identity Recovery Managementaffected: 1.8.107 before 1.8.107.1CVE List
  • WSO2 Carbon Identity Application Authentication Frameworkaffected: 5.18.248 before 5.18.248.20CVE List
  • WSO2 Carbon Identity Application Authentication Frameworkaffected: 5.24.8 before 5.24.8.9CVE List
  • WSO2 Carbon Identity Application Authentication Frameworkaffected: 5.25.705 before 5.25.705.8CVE List
  • WSO2 Carbon Identity User Storeaffected: 1.0.190 before 1.0.190.14CVE List
  • WSO2 Carbon Identity User Storeaffected: 1.2.3 before 1.2.3.4CVE List
  • WSO2 Carbon Identity User Storeaffected: 1.2.23 before 1.2.23.4CVE List

References 5