PT-2026-117485 · Wso2 · Wso2 Api Manager+8
CVE-2024-4412
·
تاريخ النشر
2026-10-19
·
تاريخ التحديث
2026-10-19
CVSS v3.1
2.7
منخفضة
| المتجه | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.
Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
إصلاح
Code Injection
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Wso2 Api Manager
Wso2 Carbon Identity Application Authentication Framework
Wso2 Carbon Identity Recovery Management
Wso2 Carbon Identity User Store
Wso2 Carbon Identity User Store Configuration Ui
Wso2 Enterprise Integrator
Wso2 Identity Server
Wso2 Identity Server As Key Manager
Wso2 Open Banking Am