{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-4412", "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "state": "PUBLISHED", "assignerShortName": "WSO2", "dateReserved": "2024-05-02T08:55:58.638Z", "datePublished": "2026-10-19T16:59:05.004Z", "dateUpdated": "2026-10-19T16:59:05.004Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "shortName": "WSO2", "dateUpdated": "2026-10-19T16:59:05.004Z"}, "title": "Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-22", "descriptions": [{"lang": "en", "value": "CAPEC-22 CAPEC-22: Injection"}]}], "affected": [{"vendor": "WSO2", "product": "WSO2 Enterprise Integrator", "versions": [{"status": "unknown", "version": "0", "lessThan": "6.6.0", "versionType": "custom"}, {"status": "affected", "version": "6.6.0", "lessThan": "6.6.0.205", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 API Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "3.1.0", "versionType": "custom"}, {"status": "affected", "version": "3.1.0", "lessThan": "3.1.0.276", "versionType": "custom"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.0.366", "versionType": "custom"}, {"status": "affected", "version": "3.2.1", "lessThan": "3.2.1.18", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThan": "4.0.0.307", "versionType": "custom"}, {"status": "affected", "version": "4.1.0", "lessThan": "4.1.0.169", "versionType": "custom"}, {"status": "affected", "version": "4.2.0", "lessThan": "4.2.0.108", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThan": "4.3.0.20", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking IAM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.346", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.297", "versionType": "custom"}, {"status": "affected", "version": "5.11.0", "lessThan": "5.11.0.337", "versionType": "custom"}, {"status": "affected", "version": "6.0.0", "lessThan": "6.0.0.189", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.0.149", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.0.0.15", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Identity Server as Key Manager", "versions": [{"status": "unknown", "version": "0", "lessThan": "5.10.0", "versionType": "custom"}, {"status": "affected", "version": "5.10.0", "lessThan": "5.10.0.293", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Open Banking AM", "versions": [{"status": "unknown", "version": "0", "lessThan": "2.0.0", "versionType": "custom"}, {"status": "affected", "version": "2.0.0", "lessThan": "2.0.0.326", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity User Store Configuration UI", "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui", "versions": [{"status": "affected", "version": "5.14.127", "lessThan": "5.14.127.8", "versionType": "custom"}, {"status": "affected", "version": "5.17.5", "lessThan": "5.17.5.266", "versionType": "custom"}, {"status": "affected", "version": "5.17.118", "lessThan": "5.17.118.6", "versionType": "custom"}, {"status": "affected", "version": "5.18.187", "lessThan": "5.18.187.253", "versionType": "custom"}, {"status": "affected", "version": "5.18.248", "lessThan": "5.18.248.20", "versionType": "custom"}, {"status": "affected", "version": "5.23.8", "lessThan": "5.23.8.178", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.9", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.81", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.8", "versionType": "custom"}, {"status": "affected", "version": "7.0.78", "lessThan": "7.0.78.12", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity User Store Configuration", "packageName": "org.wso2.carbon.identity.user.store.configuration", "versions": [{"status": "affected", "version": "5.14.127", "lessThan": "5.14.127.8", "versionType": "custom"}, {"status": "affected", "version": "5.17.5", "lessThan": "5.17.5.266", "versionType": "custom"}, {"status": "affected", "version": "5.17.118", "lessThan": "5.17.118.6", "versionType": "custom"}, {"status": "affected", "version": "5.18.187", "lessThan": "5.18.187.253", "versionType": "custom"}, {"status": "affected", "version": "5.18.248", "lessThan": "5.18.248.20", "versionType": "custom"}, {"status": "affected", "version": "5.23.8", "lessThan": "5.23.8.178", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.9", "versionType": "custom"}, {"status": "affected", "version": "5.25.92", "lessThan": "5.25.92.81", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.8", "versionType": "custom"}, {"status": "affected", "version": "7.0.78", "lessThan": "7.0.78.12", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Recovery Management", "packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery", "versions": [{"status": "affected", "version": "1.4.72", "lessThan": "1.4.72.66", "versionType": "custom"}, {"status": "affected", "version": "1.4.100", "lessThan": "1.4.100.6", "versionType": "custom"}, {"status": "affected", "version": "1.7.2", "lessThan": "1.7.2.2", "versionType": "custom"}, {"status": "affected", "version": "1.8.107", "lessThan": "1.8.107.1", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity Application Authentication Framework", "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework", "versions": [{"status": "affected", "version": "5.18.248", "lessThan": "5.18.248.20", "versionType": "custom"}, {"status": "affected", "version": "5.24.8", "lessThan": "5.24.8.9", "versionType": "custom"}, {"status": "affected", "version": "5.25.705", "lessThan": "5.25.705.8", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "WSO2", "product": "WSO2 Carbon Identity User Store", "packageName": "org.wso2.carbon.identity.api.server.userstore.v1", "versions": [{"status": "affected", "version": "1.0.190", "lessThan": "1.0.190.14", "versionType": "custom"}, {"status": "affected", "version": "1.2.3", "lessThan": "1.2.3.4", "versionType": "custom"}, {"status": "affected", "version": "1.2.23", "lessThan": "1.2.23.4", "versionType": "custom"}], "defaultStatus": "unknown"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.0", "versionEndExcluding": "6.6.0.205"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.1.0", "versionEndExcluding": "3.1.0.276"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.0", "versionEndExcluding": "3.2.0.366"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2.1", "versionEndExcluding": "3.2.1.18"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "4.0.0.307"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.1.0", "versionEndExcluding": "4.1.0.169"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.2.0", "versionEndExcluding": "4.2.0.108"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.3.0", "versionEndExcluding": "4.3.0.20"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.0.0.346"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.0", "versionEndExcluding": "5.10.0.297"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.0", "versionEndExcluding": "5.11.0.337"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "6.0.0.189"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.0", "versionEndExcluding": "6.1.0.149"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.0.0.15"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.0", "versionEndExcluding": "5.10.0.293"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.0.0", "versionEndExcluding": "2.0.0.326"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14.127", "versionEndExcluding": "5.14.127.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.5", "versionEndExcluding": "5.17.5.266"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.118", "versionEndExcluding": "5.17.118.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.187", "versionEndExcluding": "5.18.187.253"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.248", "versionEndExcluding": "5.18.248.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.23.8", "versionEndExcluding": "5.23.8.178"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.24.8", "versionEndExcluding": "5.24.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.92", "versionEndExcluding": "5.25.92.81"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.705", "versionEndExcluding": "5.25.705.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.78", "versionEndExcluding": "7.0.78.12"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14.127", "versionEndExcluding": "5.14.127.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.5", "versionEndExcluding": "5.17.5.266"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.118", "versionEndExcluding": "5.17.118.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.187", "versionEndExcluding": "5.18.187.253"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.248", "versionEndExcluding": "5.18.248.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.23.8", "versionEndExcluding": "5.23.8.178"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.24.8", "versionEndExcluding": "5.24.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.92", "versionEndExcluding": "5.25.92.81"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.705", "versionEndExcluding": "5.25.705.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.78", "versionEndExcluding": "7.0.78.12"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.4.72", "versionEndExcluding": "1.4.72.66"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.4.100", "versionEndExcluding": "1.4.100.6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.7.2", "versionEndExcluding": "1.7.2.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.8.107", "versionEndExcluding": "1.8.107.1"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.248", "versionEndExcluding": "5.18.248.20"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.24.8", "versionEndExcluding": "5.24.8.9"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.25.705", "versionEndExcluding": "5.25.705.8"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.190", "versionEndExcluding": "1.0.190.14"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.2.3", "versionEndExcluding": "1.2.3.4"}, {"vulnerable": true, "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.2.23", "versionEndExcluding": "1.2.23.4"}]}]}], "descriptions": [{"lang": "en", "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."}]}], "references": [{"url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/", "tags": ["vendor-advisory"]}, {"url": "https://github.com/wso2-extensions/identity-governance/pull/848", "tags": ["patch"]}, {"url": "https://github.com/wso2/carbon-identity-framework/pull/5895", "tags": ["patch"]}, {"url": "https://github.com/wso2/identity-apps/pull/6829", "tags": ["patch"]}, {"url": "https://github.com/wso2/product-apim/pull/13524", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 2.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}}], "solutions": [{"lang": "en", "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution</span></a> <br>"}]}], "source": {"advisory": "WSO2-2023-3098", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WSO2 Enterprise Integrator", "vendor": "WSO2", "versions": [{"lessThan": "6.6.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "6.6.0.205", "status": "affected", "version": "6.6.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 API Manager", "vendor": "WSO2", "versions": [{"lessThan": "3.1.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "3.1.0.276", "status": "affected", "version": "3.1.0", "versionType": "custom"}, {"lessThan": "3.2.0.366", "status": "affected", "version": "3.2.0", "versionType": "custom"}, {"lessThan": "3.2.1.18", "status": "affected", "version": "3.2.1", "versionType": "custom"}, {"lessThan": "4.0.0.307", "status": "affected", "version": "4.0.0", "versionType": "custom"}, {"lessThan": "4.1.0.169", "status": "affected", "version": "4.1.0", "versionType": "custom"}, {"lessThan": "4.2.0.108", "status": "affected", "version": "4.2.0", "versionType": "custom"}, {"lessThan": "4.3.0.20", "status": "affected", "version": "4.3.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking IAM", "vendor": "WSO2", "versions": [{"lessThan": "2.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.0.0.346", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server", "vendor": "WSO2", "versions": [{"lessThan": "5.10.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.10.0.297", "status": "affected", "version": "5.10.0", "versionType": "custom"}, {"lessThan": "5.11.0.337", "status": "affected", "version": "5.11.0", "versionType": "custom"}, {"lessThan": "6.0.0.189", "status": "affected", "version": "6.0.0", "versionType": "custom"}, {"lessThan": "6.1.0.149", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "7.0.0.15", "status": "affected", "version": "7.0.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Identity Server as Key Manager", "vendor": "WSO2", "versions": [{"lessThan": "5.10.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "5.10.0.293", "status": "affected", "version": "5.10.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "WSO2 Open Banking AM", "vendor": "WSO2", "versions": [{"lessThan": "2.0.0", "status": "unknown", "version": "0", "versionType": "custom"}, {"lessThan": "2.0.0.326", "status": "affected", "version": "2.0.0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui", "product": "WSO2 Carbon Identity User Store Configuration UI", "vendor": "WSO2", "versions": [{"lessThan": "5.14.127.8", "status": "affected", "version": "5.14.127", "versionType": "custom"}, {"lessThan": "5.17.5.266", "status": "affected", "version": "5.17.5", "versionType": "custom"}, {"lessThan": "5.17.118.6", "status": "affected", "version": "5.17.118", "versionType": "custom"}, {"lessThan": "5.18.187.253", "status": "affected", "version": "5.18.187", "versionType": "custom"}, {"lessThan": "5.18.248.20", "status": "affected", "version": "5.18.248", "versionType": "custom"}, {"lessThan": "5.23.8.178", "status": "affected", "version": "5.23.8", "versionType": "custom"}, {"lessThan": "5.24.8.9", "status": "affected", "version": "5.24.8", "versionType": "custom"}, {"lessThan": "5.25.92.81", "status": "affected", "version": "5.25.92", "versionType": "custom"}, {"lessThan": "5.25.705.8", "status": "affected", "version": "5.25.705", "versionType": "custom"}, {"lessThan": "7.0.78.12", "status": "affected", "version": "7.0.78", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.user.store.configuration", "product": "WSO2 Carbon Identity User Store Configuration", "vendor": "WSO2", "versions": [{"lessThan": "5.14.127.8", "status": "affected", "version": "5.14.127", "versionType": "custom"}, {"lessThan": "5.17.5.266", "status": "affected", "version": "5.17.5", "versionType": "custom"}, {"lessThan": "5.17.118.6", "status": "affected", "version": "5.17.118", "versionType": "custom"}, {"lessThan": "5.18.187.253", "status": "affected", "version": "5.18.187", "versionType": "custom"}, {"lessThan": "5.18.248.20", "status": "affected", "version": "5.18.248", "versionType": "custom"}, {"lessThan": "5.23.8.178", "status": "affected", "version": "5.23.8", "versionType": "custom"}, {"lessThan": "5.24.8.9", "status": "affected", "version": "5.24.8", "versionType": "custom"}, {"lessThan": "5.25.92.81", "status": "affected", "version": "5.25.92", "versionType": "custom"}, {"lessThan": "5.25.705.8", "status": "affected", "version": "5.25.705", "versionType": "custom"}, {"lessThan": "7.0.78.12", "status": "affected", "version": "7.0.78", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery", "product": "WSO2 Carbon Identity Recovery Management", "vendor": "WSO2", "versions": [{"lessThan": "1.4.72.66", "status": "affected", "version": "1.4.72", "versionType": "custom"}, {"lessThan": "1.4.100.6", "status": "affected", "version": "1.4.100", "versionType": "custom"}, {"lessThan": "1.7.2.2", "status": "affected", "version": "1.7.2", "versionType": "custom"}, {"lessThan": "1.8.107.1", "status": "affected", "version": "1.8.107", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework", "product": "WSO2 Carbon Identity Application Authentication Framework", "vendor": "WSO2", "versions": [{"lessThan": "5.18.248.20", "status": "affected", "version": "5.18.248", "versionType": "custom"}, {"lessThan": "5.24.8.9", "status": "affected", "version": "5.24.8", "versionType": "custom"}, {"lessThan": "5.25.705.8", "status": "affected", "version": "5.25.705", "versionType": "custom"}]}, {"defaultStatus": "unknown", "packageName": "org.wso2.carbon.identity.api.server.userstore.v1", "product": "WSO2 Carbon Identity User Store", "vendor": "WSO2", "versions": [{"lessThan": "1.0.190.14", "status": "affected", "version": "1.0.190", "versionType": "custom"}, {"lessThan": "1.2.3.4", "status": "affected", "version": "1.2.3", "versionType": "custom"}, {"lessThan": "1.2.23.4", "status": "affected", "version": "1.2.23", "versionType": "custom"}]}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."}], "id": "CVE-2024-4412", "lastModified": "2026-10-19T21:06:28.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}, "published": "2026-10-19T17:16:57.837", "references": [{"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://github.com/wso2-extensions/identity-governance/pull/848"}, {"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://github.com/wso2/carbon-identity-framework/pull/5895"}, {"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://github.com/wso2/identity-apps/pull/6829"}, {"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://github.com/wso2/product-apim/pull/13524"}, {"source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"}], "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10.0,5.10.0.297)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.11.0,5.11.0.337)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0.0,6.0.0.189)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1.0,6.1.0.149)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.0,7.0.0.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server", "source": "cna", "vendor": "WSO2"}, "product": "identity_server", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.1.0,3.1.0.276)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.0,3.2.0.366)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.2.1,3.2.1.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.0.0,4.0.0.307)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.1.0,4.1.0.169)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.2.0,4.2.0.108)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[4.3.0,4.3.0.20)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 API Manager", "source": "cna", "vendor": "WSO2"}, "product": "wso2_api_manager", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.18.248,5.18.248.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.24.8,5.24.8.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.25.705,5.25.705.8)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Carbon Identity Application Authentication Framework", "source": "cna", "vendor": "WSO2"}, "product": "wso2_carbon_identity_application_authentication_framework", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.4.72,1.4.72.66)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.4.100,1.4.100.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.7.2,1.7.2.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.8.107,1.8.107.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Carbon Identity Recovery Management", "source": "cna", "vendor": "WSO2"}, "product": "wso2_carbon_identity_recovery_management", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.0.190,1.0.190.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.2.3,1.2.3.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[1.2.23,1.2.23.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Carbon Identity User Store", "source": "cna", "vendor": "WSO2"}, "product": "wso2_carbon_identity_user_store", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.14.127,5.14.127.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.17.5,5.17.5.266)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.17.118,5.17.118.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.18.187,5.18.187.253)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.18.248,5.18.248.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.23.8,5.23.8.178)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.24.8,5.24.8.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.25.92,5.25.92.81)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.25.705,5.25.705.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.78,7.0.78.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Carbon Identity User Store Configuration", "source": "cna", "vendor": "WSO2"}, "product": "wso2_carbon_identity_user_store_configuration", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.14.127,5.14.127.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.17.5,5.17.5.266)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.17.118,5.17.118.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.18.187,5.18.187.253)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.18.248,5.18.248.20)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.23.8,5.23.8.178)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.24.8,5.24.8.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.25.92,5.25.92.81)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.25.705,5.25.705.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.78,7.0.78.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Carbon Identity User Store Configuration UI", "source": "cna", "vendor": "WSO2"}, "product": "wso2_carbon_identity_user_store_configuration_ui", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.6.0,6.6.0.205)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Enterprise Integrator", "source": "cna", "vendor": "WSO2"}, "product": "wso2_enterprise_integrator", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10.0,5.10.0.297)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.11.0,5.11.0.337)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.0.0,6.0.0.189)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1.0,6.1.0.149)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[7.0.0,7.0.0.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server", "source": "cna", "vendor": "WSO2"}, "product": "wso2_identity_server", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.10.0,5.10.0.293)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Identity Server as Key Manager", "source": "cna", "vendor": "WSO2"}, "product": "wso2_identity_server_as_key_manager", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0,2.0.0.326)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Open Banking AM", "source": "cna", "vendor": "WSO2"}, "product": "wso2_open_banking_am", "vendor": "wso2"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0,2.0.0.346)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WSO2 Open Banking IAM", "source": "cna", "vendor": "WSO2"}, "product": "wso2_open_banking_iam", "vendor": "wso2"}], "created": "2026-10-19T18:30:02.315641+00:00", "updated": "2026-10-20T02:00:09.547271+00:00", "vendors": ["wso2", "wso2$PRODUCT$identity_server", "wso2$PRODUCT$wso2_api_manager", "wso2$PRODUCT$wso2_carbon_identity_application_authentication_framework", "wso2$PRODUCT$wso2_carbon_identity_recovery_management", "wso2$PRODUCT$wso2_carbon_identity_user_store", "wso2$PRODUCT$wso2_carbon_identity_user_store_configuration", "wso2$PRODUCT$wso2_carbon_identity_user_store_configuration_ui", "wso2$PRODUCT$wso2_enterprise_integrator", "wso2$PRODUCT$wso2_identity_server", "wso2$PRODUCT$wso2_identity_server_as_key_manager", "wso2$PRODUCT$wso2_open_banking_am", "wso2$PRODUCT$wso2_open_banking_iam"]}