CVE-2024-4412 - Vulnerability Details

CVE-2024-4412 - Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.

Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WSO2

WSO2 Enterprise Integrator

unaffected

Version	Status	Constraints
`0`	unknown	< 6.6.0
`6.6.0`	affected	< 6.6.0.205

WSO2

WSO2 API Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 3.1.0
`3.1.0`	affected	< 3.1.0.276
`3.2.0`	affected	< 3.2.0.366
`3.2.1`	affected	< 3.2.1.18
`4.0.0`	affected	< 4.0.0.307
`4.1.0`	affected	< 4.1.0.169
`4.2.0`	affected	< 4.2.0.108
`4.3.0`	affected	< 4.3.0.20

WSO2

WSO2 Open Banking IAM

unaffected

Version	Status	Constraints
`0`	unknown	< 2.0.0
`2.0.0`	affected	< 2.0.0.346

WSO2

WSO2 Identity Server

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10.0
`5.10.0`	affected	< 5.10.0.297
`5.11.0`	affected	< 5.11.0.337
`6.0.0`	affected	< 6.0.0.189
`6.1.0`	affected	< 6.1.0.149
`7.0.0`	affected	< 7.0.0.15

WSO2

WSO2 Identity Server as Key Manager

unaffected

Version	Status	Constraints
`0`	unknown	< 5.10.0
`5.10.0`	affected	< 5.10.0.293

WSO2

WSO2 Open Banking AM

unaffected

Version	Status	Constraints
`0`	unknown	< 2.0.0
`2.0.0`	affected	< 2.0.0.326

WSO2

WSO2 Carbon Identity User Store Configuration UI

unknown

Version	Status	Constraints
`5.14.127`	affected	< 5.14.127.8
`5.17.5`	affected	< 5.17.5.266
`5.17.118`	affected	< 5.17.118.6
`5.18.187`	affected	< 5.18.187.253
`5.18.248`	affected	< 5.18.248.20
`5.23.8`	affected	< 5.23.8.178
`5.24.8`	affected	< 5.24.8.9
`5.25.92`	affected	< 5.25.92.81
`5.25.705`	affected	< 5.25.705.8
`7.0.78`	affected	< 7.0.78.12

WSO2

WSO2 Carbon Identity User Store Configuration

unknown

Version	Status	Constraints
`5.14.127`	affected	< 5.14.127.8
`5.17.5`	affected	< 5.17.5.266
`5.17.118`	affected	< 5.17.118.6
`5.18.187`	affected	< 5.18.187.253
`5.18.248`	affected	< 5.18.248.20
`5.23.8`	affected	< 5.23.8.178
`5.24.8`	affected	< 5.24.8.9
`5.25.92`	affected	< 5.25.92.81
`5.25.705`	affected	< 5.25.705.8
`7.0.78`	affected	< 7.0.78.12

WSO2

WSO2 Carbon Identity Recovery Management

unknown

Version	Status	Constraints
`1.4.72`	affected	< 1.4.72.66
`1.4.100`	affected	< 1.4.100.6
`1.7.2`	affected	< 1.7.2.2
`1.8.107`	affected	< 1.8.107.1

WSO2

WSO2 Carbon Identity Application Authentication Framework

unknown

Version	Status	Constraints
`5.18.248`	affected	< 5.18.248.20
`5.24.8`	affected	< 5.24.8.9
`5.25.705`	affected	< 5.25.705.8

WSO2

WSO2 Carbon Identity User Store

unknown

Version	Status	Constraints
`1.0.190`	affected	< 1.0.190.14
`1.2.3`	affected	< 1.2.3.4
`1.2.23`	affected	< 1.2.23.4

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors	Products
Wso2 Subscribe	Wso2 Api Manager Subscribe Wso2 Carbon Identity Application Authentication Framework Subscribe Wso2 Carbon Identity Recovery Management Subscribe Wso2 Carbon Identity User Store Subscribe Wso2 Carbon Identity User Store Configuration Subscribe Wso2 Carbon Identity User Store Configuration Ui Subscribe Wso2 Enterprise Integrator Subscribe Wso2 Identity Server Subscribe Wso2 Identity Server As Key Manager Subscribe Wso2 Open Banking Am Subscribe Wso2 Open Banking Iam Subscribe

Advisories

No advisories yet.

Fixes

Solution

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/wso2-extensions/identity-governance/pull/848
https://github.com/wso2/carbon-identity-framework/pull/5895
https://github.com/wso2/identity-apps/pull/6829
https://github.com/wso2/product-apim/pull/13524
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/

History

Mon, 19 Oct 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
Title		Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
First Time appeared		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carbon Identity Application Authentication Framework Wso2 wso2 Carbon Identity Recovery Management Wso2 wso2 Carbon Identity User Store Wso2 wso2 Carbon Identity User Store Configuration Wso2 wso2 Carbon Identity User Store Configuration Ui Wso2 wso2 Enterprise Integrator Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam
Weaknesses		CWE-94
CPEs		cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_enterprise_integrator:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:::::::: cpe:2.3:a:wso2:wso2_open_banking_am:::::::: cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
Vendors & Products		Wso2 Wso2 wso2 Api Manager Wso2 wso2 Carbon Identity Application Authentication Framework Wso2 wso2 Carbon Identity Recovery Management Wso2 wso2 Carbon Identity User Store Wso2 wso2 Carbon Identity User Store Configuration Wso2 wso2 Carbon Identity User Store Configuration Ui Wso2 wso2 Enterprise Integrator Wso2 wso2 Identity Server Wso2 wso2 Identity Server As Key Manager Wso2 wso2 Open Banking Am Wso2 wso2 Open Banking Iam
References		https://github.com/wso2-extensions/identity-governance/pull/848 https://github.com/wso2/carbon-identity-framework/pull/5895 https://github.com/wso2/identity-apps/pull/6829 https://github.com/wso2/product-apim/pull/13524 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/
Metrics		cvssV3_1 `{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: WSO2

Published: 2026-10-19T16:59:05.004Z

Updated: 2026-10-19T16:59:05.004Z

Reserved: 2024-05-02T08:55:58.638Z

Link: CVE-2024-4412

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-10-19T17:16:57.837

Modified: 2026-10-19T21:06:28.507

Link: CVE-2024-4412

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-19T18:30:02Z

Weaknesses

CWE-94

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Project Subscriptions

Projects

JSON object

JSON object

JSON object

JSON object

JSON object