PT-2026-117485 · Wso2 · Wso2 Api Manager+8
CVE-2024-4412
·
Published
2026-10-19
·
Updated
2026-10-19
CVSS v3.1
2.7
Low
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N |
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.
Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wso2 Api Manager
Wso2 Carbon Identity Application Authentication Framework
Wso2 Carbon Identity Recovery Management
Wso2 Carbon Identity User Store
Wso2 Carbon Identity User Store Configuration Ui
Wso2 Enterprise Integrator
Wso2 Identity Server
Wso2 Identity Server As Key Manager
Wso2 Open Banking Am