{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-6423","assignerOrgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","state":"PUBLISHED","assignerShortName":"WSO2","dateReserved":"2024-07-01T08:23:45.912Z","datePublished":"2026-10-21T13:56:26.552Z","dateUpdated":"2026-10-30T15:11:58.008Z"},"containers":{"cna":{"providerMetadata":{"orgId":"ed10eef1-636d-4fbe-9993-6890dfa878f8","shortName":"WSO2","dateUpdated":"2026-10-21T13:59:54.562Z"},"title":"Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-20","description":"CWE-20: Improper Input Validation","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-246","descriptions":[{"lang":"en","value":"CAPEC-246 CAPEC-246: Data Transmission"}]}],"affected":[{"vendor":"WSO2","product":"WSO2 API Manager","versions":[{"status":"unknown","version":"0","lessThan":"3.1.0","versionType":"custom"},{"status":"affected","version":"3.1.0","lessThan":"3.1.0.313","versionType":"custom"},{"status":"affected","version":"3.2.0","lessThan":"3.2.0.406","versionType":"custom"},{"status":"affected","version":"3.2.1","lessThan":"3.2.1.30","versionType":"custom"},{"status":"affected","version":"4.0.0","lessThan":"4.0.0.324","versionType":"custom"},{"status":"affected","version":"4.1.0","lessThan":"4.1.0.185","versionType":"custom"},{"status":"affected","version":"4.2.0","lessThan":"4.2.0.124","versionType":"custom"},{"status":"affected","version":"4.3.0","lessThan":"4.3.0.36","versionType":"custom"},{"status":"affected","version":"4.4.0","lessThan":"4.4.0.2","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Open Banking AM","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.363","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Identity Server","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.337","versionType":"custom"},{"status":"affected","version":"5.11.0","lessThan":"5.11.0.384","versionType":"custom"},{"status":"affected","version":"6.0.0","lessThan":"6.0.0.213","versionType":"custom"},{"status":"affected","version":"6.1.0","lessThan":"6.1.0.211","versionType":"custom"},{"status":"affected","version":"7.0.0","lessThan":"7.0.0.50","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Identity Server as Key Manager","versions":[{"status":"unknown","version":"0","lessThan":"5.10.0","versionType":"custom"},{"status":"affected","version":"5.10.0","lessThan":"5.10.0.329","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Open Banking IAM","versions":[{"status":"unknown","version":"0","lessThan":"2.0.0","versionType":"custom"},{"status":"affected","version":"2.0.0","lessThan":"2.0.0.381","versionType":"custom"}],"defaultStatus":"unaffected"},{"vendor":"WSO2","product":"WSO2 Carbon Identity Application","packageName":"org.wso2.carbon.identity.application.authenticator.basicauth","versions":[{"status":"affected","version":"6.3.0","lessThan":"6.3.0.18","versionType":"custom"},{"status":"affected","version":"6.3.11","lessThan":"6.3.11.23","versionType":"custom"},{"status":"affected","version":"6.3.58","lessThan":"6.3.58.1","versionType":"custom"},{"status":"affected","version":"6.5.0","lessThan":"6.5.0.5","versionType":"custom"},{"status":"affected","version":"6.6.0","lessThan":"6.6.0.1","versionType":"custom"},{"status":"affected","version":"6.7.8","lessThan":"6.7.8.4","versionType":"custom"},{"status":"affected","version":"6.7.32","lessThan":"6.7.32.1","versionType":"custom"},{"status":"unaffected","version":"x","lessThanOrEqual":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"WSO2","product":"WSO2 Carbon Identity Core","packageName":"org.wso2.carbon.identity.core","versions":[{"status":"affected","version":"5.17.5","lessThan":"5.17.5.286","versionType":"custom"},{"status":"affected","version":"5.17.118","lessThan":"5.17.118.11","versionType":"custom"},{"status":"affected","version":"5.18.187","lessThan":"5.18.187.263","versionType":"custom"},{"status":"affected","version":"5.18.248","lessThan":"5.18.248.23","versionType":"custom"},{"status":"affected","version":"5.23.8","lessThan":"5.23.8.189","versionType":"custom"},{"status":"affected","version":"5.24.8","lessThan":"5.24.8.12","versionType":"custom"},{"status":"affected","version":"5.25.92","lessThan":"5.25.92.91","versionType":"custom"},{"status":"affected","version":"5.25.92","lessThan":"5.25.92.118","versionType":"custom"},{"status":"affected","version":"5.25.705","lessThan":"5.25.705.11","versionType":"custom"},{"status":"affected","version":"5.25.713","lessThan":"5.25.713.2","versionType":"custom"},{"status":"affected","version":"7.0.78","lessThan":"7.0.78.27","versionType":"custom"},{"status":"unaffected","version":"x","lessThanOrEqual":"*","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"WSO2","product":"WSO2 Carbon Identity Oauth","packageName":"org.wso2.carbon.identity.oauth.common","versions":[{"status":"affected","version":"6.4.2","lessThan":"6.4.2.142","versionType":"custom"},{"status":"affected","version":"6.4.176","lessThan":"6.4.176.20","versionType":"custom"},{"status":"affected","version":"6.4.180","lessThan":"6.4.180.8","versionType":"custom"},{"status":"affected","version":"6.8.0","lessThan":"6.8.0.40","versionType":"custom"},{"status":"affected","version":"6.9.6","lessThan":"6.9.6.16","versionType":"custom"},{"status":"affected","version":"6.11.21","lessThan":"6.11.21.44","versionType":"custom"},{"status":"affected","version":"6.13.16","lessThan":"6.13.16.6","versionType":"custom"},{"status":"affected","version":"6.13.19","lessThan":"6.13.19.2","versionType":"custom"},{"status":"affected","version":"7.0.26","lessThan":"7.0.26.18","versionType":"custom"}],"defaultStatus":"unknown"}],"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.1.0","versionEndExcluding":"3.1.0.313"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.0","versionEndExcluding":"3.2.0.406"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.1","versionEndExcluding":"3.2.1.30"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.0.0","versionEndExcluding":"4.0.0.324"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.0.185"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.0.124"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.3.0","versionEndExcluding":"4.3.0.36"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.0","versionEndExcluding":"4.4.0.2"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.0.363"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.0","versionEndExcluding":"5.10.0.337"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.0","versionEndExcluding":"5.11.0.384"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.0.213"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.0","versionEndExcluding":"6.1.0.211"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0","versionEndExcluding":"7.0.0.50"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.0","versionEndExcluding":"5.10.0.329"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.0","versionEndExcluding":"2.0.0.381"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.0","versionEndExcluding":"6.3.0.18"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.11","versionEndExcluding":"6.3.11.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3.58","versionEndExcluding":"6.3.58.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.5.0","versionEndExcluding":"6.5.0.5"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.0","versionEndExcluding":"6.6.0.1"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.8","versionEndExcluding":"6.7.8.4"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7.32","versionEndExcluding":"6.7.32.1"},{"vulnerable":false,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_application:*:*:*:*:*:*:*:*","versionStartIncluding":"x","versionEndIncluding":"*"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.5","versionEndExcluding":"5.17.5.286"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.17.118","versionEndExcluding":"5.17.118.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.187","versionEndExcluding":"5.18.187.263"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18.248","versionEndExcluding":"5.18.248.23"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.23.8","versionEndExcluding":"5.23.8.189"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.24.8","versionEndExcluding":"5.24.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.92","versionEndExcluding":"5.25.92.91"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.92","versionEndExcluding":"5.25.92.118"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.705","versionEndExcluding":"5.25.705.11"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"5.25.713","versionEndExcluding":"5.25.713.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.78","versionEndExcluding":"7.0.78.27"},{"vulnerable":false,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_core:*:*:*:*:*:*:*:*","versionStartIncluding":"x","versionEndIncluding":"*"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.2","versionEndExcluding":"6.4.2.142"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.176","versionEndExcluding":"6.4.176.20"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.4.180","versionEndExcluding":"6.4.180.8"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.8.0","versionEndExcluding":"6.8.0.40"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9.6","versionEndExcluding":"6.9.6.16"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11.21","versionEndExcluding":"6.11.21.44"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.16","versionEndExcluding":"6.13.16.6"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13.19","versionEndExcluding":"6.13.19.2"},{"vulnerable":true,"criteria":"cpe:2.3:a:wso2:wso2_carbon_identity_oauth:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.26","versionEndExcluding":"7.0.26.18"}]}]}],"descriptions":[{"lang":"en","value":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.","supportingMedia":[{"type":"text/html","base64":false,"value":"The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.\n\nIf a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly."}]}],"references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseSeverity":"MEDIUM","baseScore":4,"vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"}}],"solutions":[{"lang":"en","value":"Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution","supportingMedia":[{"type":"text/html","base64":false,"value":"<span style=\"background-color: transparent;\">Follow the instructions given on </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution\"><span style=\"background-color: transparent;\">https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3465/#solution</span></a> <br>"}]}],"source":{"advisory":"WSO2-2024-3465","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-30T15:11:01.346786Z","id":"CVE-2024-6423","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-30T15:11:58.008Z"}}]}}