PT-2026-117485 · Wso2 · Wso2 Api Manager+8
CVE-2024-4412
·
Publicado
2026-10-19
·
Atualizado
2026-10-19
CVSS v3.1
2.7
Baixa
| Vetor | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.
Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Correção
Code Injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Wso2 Api Manager
Wso2 Carbon Identity Application Authentication Framework
Wso2 Carbon Identity Recovery Management
Wso2 Carbon Identity User Store
Wso2 Carbon Identity User Store Configuration Ui
Wso2 Enterprise Integrator
Wso2 Identity Server
Wso2 Identity Server As Key Manager
Wso2 Open Banking Am