All vulnerabilities
CVE-2024-6423

Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage

WSO2 WSO2 API Manager
Open in ThreatlineRecord JSON
CVSS
4.0Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.10%Chance of exploitation activity in the next 30 days, higher than 0% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.1.0.313Also 3.2.0.406, 3.2.1.30 and 40 moreCVE List
Published21 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

Show all 43 fixed versions
  • 4.3.0.36WSO2 API ManagerCVE List
  • 4.4.0.2WSO2 API ManagerCVE List
  • 2.0.0.363WSO2 Open Banking AMCVE List
  • 5.10.0.337WSO2 Identity ServerCVE List
  • 5.11.0.384WSO2 Identity ServerCVE List
  • 6.0.0.213WSO2 Identity ServerCVE List
  • 6.1.0.211WSO2 Identity ServerCVE List
  • 7.0.0.50WSO2 Identity ServerCVE List
  • 5.10.0.329WSO2 Identity Server as Key ManagerCVE List
  • 2.0.0.381WSO2 Open Banking IAMCVE List
  • 6.3.0.18WSO2 Carbon Identity ApplicationCVE List
  • 6.3.11.23WSO2 Carbon Identity ApplicationCVE List
  • 6.3.58.1WSO2 Carbon Identity ApplicationCVE List
  • 6.5.0.5WSO2 Carbon Identity ApplicationCVE List
  • 6.6.0.1WSO2 Carbon Identity ApplicationCVE List
  • 6.7.8.4WSO2 Carbon Identity ApplicationCVE List
  • 6.7.32.1WSO2 Carbon Identity ApplicationCVE List
  • 5.17.5.286WSO2 Carbon Identity CoreCVE List
  • 5.17.118.11WSO2 Carbon Identity CoreCVE List
  • 5.18.187.263WSO2 Carbon Identity CoreCVE List
  • 5.18.248.23WSO2 Carbon Identity CoreCVE List
  • 5.23.8.189WSO2 Carbon Identity CoreCVE List
  • 5.24.8.12WSO2 Carbon Identity CoreCVE List
  • 5.25.92.91WSO2 Carbon Identity CoreCVE List
  • 5.25.92.118WSO2 Carbon Identity CoreCVE List
  • 5.25.705.11WSO2 Carbon Identity CoreCVE List
  • 5.25.713.2WSO2 Carbon Identity CoreCVE List
  • 7.0.78.27WSO2 Carbon Identity CoreCVE List
  • 6.4.2.142WSO2 Carbon Identity OauthCVE List
  • 6.4.176.20WSO2 Carbon Identity OauthCVE List
  • 6.4.180.8WSO2 Carbon Identity OauthCVE List
  • 6.8.0.40WSO2 Carbon Identity OauthCVE List
  • 6.9.6.16WSO2 Carbon Identity OauthCVE List
  • 6.11.21.44WSO2 Carbon Identity OauthCVE List
  • 6.13.16.6WSO2 Carbon Identity OauthCVE List
  • 6.13.19.2WSO2 Carbon Identity OauthCVE List
  • 7.0.26.18WSO2 Carbon Identity OauthCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.

If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

Text from CVE List

Affected versions 50

  • WSO2 API Managerunknown: all versions before 3.1.0CVE List
  • WSO2 API Manageraffected: 3.1.0 before 3.1.0.313CVE List
  • WSO2 API Manageraffected: 3.2.0 before 3.2.0.406CVE List
  • WSO2 API Manageraffected: 3.2.1 before 3.2.1.30CVE List
  • WSO2 API Manageraffected: 4.0.0 before 4.0.0.324CVE List
  • WSO2 API Manageraffected: 4.1.0 before 4.1.0.185CVE List
  • WSO2 API Manageraffected: 4.2.0 before 4.2.0.124CVE List
  • WSO2 API Manageraffected: 4.3.0 before 4.3.0.36CVE List
  • WSO2 API Manageraffected: 4.4.0 before 4.4.0.2CVE List
  • WSO2 Open Banking AMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking AMaffected: 2.0.0 before 2.0.0.363CVE List
  • WSO2 Identity Serverunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Serveraffected: 5.10.0 before 5.10.0.337CVE List
  • WSO2 Identity Serveraffected: 5.11.0 before 5.11.0.384CVE List
  • WSO2 Identity Serveraffected: 6.0.0 before 6.0.0.213CVE List
  • WSO2 Identity Serveraffected: 6.1.0 before 6.1.0.211CVE List
  • WSO2 Identity Serveraffected: 7.0.0 before 7.0.0.50CVE List
  • WSO2 Identity Server as Key Managerunknown: all versions before 5.10.0CVE List
  • WSO2 Identity Server as Key Manageraffected: 5.10.0 before 5.10.0.329CVE List
  • WSO2 Open Banking IAMunknown: all versions before 2.0.0CVE List
  • WSO2 Open Banking IAMaffected: 2.0.0 before 2.0.0.381CVE List
  • WSO2 Carbon Identity Applicationaffected: 6.3.0 before 6.3.0.18CVE List
  • WSO2 Carbon Identity Applicationaffected: 6.3.11 before 6.3.11.23CVE List
  • WSO2 Carbon Identity Applicationaffected: 6.3.58 before 6.3.58.1CVE List
  • WSO2 Carbon Identity Applicationaffected: 6.5.0 before 6.5.0.5CVE List
  • WSO2 Carbon Identity Applicationaffected: 6.6.0 before 6.6.0.1CVE List
  • WSO2 Carbon Identity Applicationaffected: 6.7.8 before 6.7.8.4CVE List
  • WSO2 Carbon Identity Applicationaffected: 6.7.32 before 6.7.32.1CVE List
  • WSO2 Carbon Identity Applicationunaffected: xCVE List
  • WSO2 Carbon Identity Coreaffected: 5.17.5 before 5.17.5.286CVE List
  • WSO2 Carbon Identity Coreaffected: 5.17.118 before 5.17.118.11CVE List
  • WSO2 Carbon Identity Coreaffected: 5.18.187 before 5.18.187.263CVE List
  • WSO2 Carbon Identity Coreaffected: 5.18.248 before 5.18.248.23CVE List
  • WSO2 Carbon Identity Coreaffected: 5.23.8 before 5.23.8.189CVE List
  • WSO2 Carbon Identity Coreaffected: 5.24.8 before 5.24.8.12CVE List
  • WSO2 Carbon Identity Coreaffected: 5.25.92 before 5.25.92.91CVE List
  • WSO2 Carbon Identity Coreaffected: 5.25.92 before 5.25.92.118CVE List
  • WSO2 Carbon Identity Coreaffected: 5.25.705 before 5.25.705.11CVE List
  • WSO2 Carbon Identity Coreaffected: 5.25.713 before 5.25.713.2CVE List
  • WSO2 Carbon Identity Coreaffected: 7.0.78 before 7.0.78.27CVE List
  • WSO2 Carbon Identity Coreunaffected: xCVE List
  • WSO2 Carbon Identity Oauthaffected: 6.4.2 before 6.4.2.142CVE List
  • WSO2 Carbon Identity Oauthaffected: 6.4.176 before 6.4.176.20CVE List
  • WSO2 Carbon Identity Oauthaffected: 6.4.180 before 6.4.180.8CVE List
  • WSO2 Carbon Identity Oauthaffected: 6.8.0 before 6.8.0.40CVE List
  • WSO2 Carbon Identity Oauthaffected: 6.9.6 before 6.9.6.16CVE List
  • WSO2 Carbon Identity Oauthaffected: 6.11.21 before 6.11.21.44CVE List
  • WSO2 Carbon Identity Oauthaffected: 6.13.16 before 6.13.16.6CVE List
  • WSO2 Carbon Identity Oauthaffected: 6.13.19 before 6.13.19.2CVE List
  • WSO2 Carbon Identity Oauthaffected: 7.0.26 before 7.0.26.18CVE List

References 1