Low

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Type: advisorySource: Official CVE List1 source record

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Announced 19 Oct 2026Source revision 1

Original source ↗

CVE-2024-4412

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-4412

WSO2 Enterprise Integrator

Source reference: /containers/cna/affected/0/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 API Manager

Source reference: /containers/cna/affected/1/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Open Banking IAM

Source reference: /containers/cna/affected/2/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Identity Server

Source reference: /containers/cna/affected/3/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Identity Server as Key Manager

Source reference: /containers/cna/affected/4/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Open Banking AM

Source reference: /containers/cna/affected/5/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Carbon Identity User Store Configuration UI

Source reference: /containers/cna/affected/6/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Carbon Identity User Store Configuration

Source reference: /containers/cna/affected/7/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Carbon Identity Recovery Management

Source reference: /containers/cna/affected/8/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Carbon Identity Application Authentication Framework

Source reference: /containers/cna/affected/9/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

WSO2 Carbon Identity User Store

Source reference: /containers/cna/affected/10/product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Enterprise Integrator",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "6.6.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.6.0",
        "lessThan": "6.6.0.205",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 API Manager",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "3.1.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.1.0",
        "lessThan": "3.1.0.276",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.2.0",
        "lessThan": "3.2.0.366",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.2.1",
        "lessThan": "3.2.1.18",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.0.0",
        "lessThan": "4.0.0.307",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.1.0",
        "lessThan": "4.1.0.169",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.2.0",
        "lessThan": "4.2.0.108",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.3.0",
        "lessThan": "4.3.0.20",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Open Banking IAM",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "2.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.0.346",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.297",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.11.0",
        "lessThan": "5.11.0.337",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThan": "6.0.0.189",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.1.0",
        "lessThan": "6.1.0.149",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.15",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server as Key Manager",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.293",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Open Banking AM",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "2.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.0.326",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity User Store Configuration UI",
    "versions": [
      {
        "status": "affected",
        "version": "5.14.127",
        "lessThan": "5.14.127.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.5",
        "lessThan": "5.17.5.266",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.118",
        "lessThan": "5.17.118.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.187",
        "lessThan": "5.18.187.253",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.248",
        "lessThan": "5.18.248.20",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.23.8",
        "lessThan": "5.23.8.178",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.24.8",
        "lessThan": "5.24.8.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.92",
        "lessThan": "5.25.92.81",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.705",
        "lessThan": "5.25.705.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.78",
        "lessThan": "7.0.78.12",
        "versionType": "custom"
      }
    ],
    "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity User Store Configuration",
    "versions": [
      {
        "status": "affected",
        "version": "5.14.127",
        "lessThan": "5.14.127.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.5",
        "lessThan": "5.17.5.266",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.118",
        "lessThan": "5.17.118.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.187",
        "lessThan": "5.18.187.253",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.248",
        "lessThan": "5.18.248.20",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.23.8",
        "lessThan": "5.23.8.178",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.24.8",
        "lessThan": "5.24.8.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.92",
        "lessThan": "5.25.92.81",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.705",
        "lessThan": "5.25.705.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.78",
        "lessThan": "7.0.78.12",
        "versionType": "custom"
      }
    ],
    "packageName": "org.wso2.carbon.identity.user.store.configuration",
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity Recovery Management",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.72",
        "lessThan": "1.4.72.66",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.4.100",
        "lessThan": "1.4.100.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.7.2",
        "lessThan": "1.7.2.2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.8.107",
        "lessThan": "1.8.107.1",
        "versionType": "custom"
      }
    ],
    "packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity Application Authentication Framework",
    "versions": [
      {
        "status": "affected",
        "version": "5.18.248",
        "lessThan": "5.18.248.20",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.24.8",
        "lessThan": "5.24.8.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.705",
        "lessThan": "5.25.705.8",
        "versionType": "custom"
      }
    ],
    "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity User Store",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.190",
        "lessThan": "1.0.190.14",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.2.3",
        "lessThan": "1.2.3.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.2.23",
        "lessThan": "1.2.23.4",
        "versionType": "custom"
      }
    ],
    "packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
    "defaultStatus": "unknown"
  }
]

Related CVEs: CVE-2024-4412
Source reference: /cveMetadata/cveId

Publisher severity

low

Source reference: /containers/cna/metrics

Event: #42565 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 11:45:35 GMT
Publisher date: Mon, 19 Oct 2026 16:59:05 GMT

Read the original announcement