CVE-2024-6429

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:wso2:api_manager:3.2.0:::::::*
	cpe:2.3:a:wso2:api_manager:3.2.1:::::::*
	cpe:2.3:a:wso2:api_manager:4.0.0:::::::*
	cpe:2.3:a:wso2:api_manager:4.1.0:-::::::
	cpe:2.3:a:wso2:api_manager:4.2.0:-::::::
	cpe:2.3:a:wso2:api_manager:4.3.0:-::::::
	cpe:2.3:a:wso2:api_manager:4.4.0:-::::::
	cpe:2.3:a:wso2:identity_server:5.10.0:::::::*
	cpe:2.3:a:wso2:identity_server:5.11.0:::::::*
	cpe:2.3:a:wso2:identity_server:6.0.0:::::::*
	cpe:2.3:a:wso2:identity_server:6.1.0:::::::*
	cpe:2.3:a:wso2:identity_server:7.0.0:::::::*

History

No history.

Information

Published : 2025-09-23 17:15

Updated : 2025-10-06 13:39

NVD link : CVE-2024-6429

Mitre link : CVE-2024-6429

CVE.ORG link : CVE-2024-6429

JSON object : View

Products Affected

wso2

api_manager
identity_server

CWE

CWE-451

User Interface (UI) Misrepresentation of Critical Information

{"id": "CVE-2024-6429", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-09-23T17:15:30.643", "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/", "tags": ["Vendor Advisory"], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-451"}]}], "descriptions": [{"lang": "en", "value": "A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI.\n\nBy exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content."}], "lastModified": "2025-10-06T13:39:38.010", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E31E32CD-497E-4EF5-B3FC-8718EE06EDAD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B58251E8-606B-47C8-8E50-9F9FC8C179BD"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E21D7ABF-C328-425D-B914-618C7628220B"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51465410-6B7C-40FD-A1AB-A14F650A6AC8"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "851470CC-22AB-43E4-9CC6-5E22D49B3572"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EBAB99E-6F0F-4CE9-A954-E8878826304C"}, {"criteria": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0B3E6207-B2CF-487C-9CB8-906248B665C9"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4F126CA-A2F9-44F4-968B-DF71765869E5"}, {"criteria": "cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2153AECE-020A-4C01-B2A6-F9F5D98E7EBE"}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B81C488-69D0-4A5C-AEED-31869C1BF5CA"}, {"criteria": "cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65CD2558-C60C-4296-8E96-D4D804C598F0"}, {"criteria": "cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8DF49C6-F2F6-4229-982E-0C0559265203"}], "operator": "OR"}]}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}