Medium
Security advisory
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-6429
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:15 UTC · Revision 1
Source evidence
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
osv:CVE-2024-6429
Complete source record
{
"id": "c8b480a287f527e9ce43d42076d07b20cf8ba60470959b663f774b40bf41c11a",
"url": "https://osv.dev/vulnerability/CVE-2024-6429",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2024-6429",
"summary": "A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.",
"evidence": "osv:CVE-2024-6429",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2024-6429",
"aliases": [
"CVE-2024-6429",
"GHSA-r6f3-55wj-g9p3"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/wso2/product-apim",
"type": "GIT",
"events": [
{
"introduced": "e4956e9301b1c26eb06e80ec5c86628154b6ab55"
},
{
"last_affected": "c97258caec907ea69c289c80ff708a214c3372dc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:wso2:api_manager:3.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.2.0"
},
{
"last_affected": "3.2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wso2:api_manager:4.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0.0"
},
{
"last_affected": "4.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wso2:api_manager:4.1.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "4.1.0-NA"
},
{
"last_affected": "4.1.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wso2:api_manager:4.2.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "4.2.0-NA"
},
{
"last_affected": "4.2.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wso2:api_manager:4.3.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "4.3.0-NA"
},
{
"last_affected": "4.3.0-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:wso2:api_manager:4.4.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "4.4.0-NA"
},
{
"last_affected": "4.4.0-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"3.2.0",
"4.0.0",
"4.1.0-NA",
"4.2.0-NA",
"4.3.0-NA",
"4.4.0-NA",
"v4.3.0-rc2",
"v4.3.0",
"v4.4.0-rc2",
"v4.4.0",
"v4.4.0-rc",
"v4.4.0-beta",
"v4.4.0-alpha",
"v4.4.0-m1",
"v4.3.0-rc",
"v4.3.0-beta",
"v4.3.0-alpha2",
"v4.3.0-alpha",
"v4.3.0-m2",
"v4.2.0-rc2",
"v4.2.0",
"v4.2.0-rc",
"v4.2.0-beta",
"v4.2.0-alpha",
"v4.2.0-m1",
"v4.1.0-rc3",
"v4.1.0",
"v4.1.0-rc2",
"v4.1.0-rc",
"v4.1.0-beta",
"v4.1.0-alpha",
"v4.1.0-m4",
"v4.1.0-m3",
"v4.1.0-m2",
"v4.1.0-m1",
"v4.0.0-rc",
"v4.0.0",
"4.0.0-beta",
"v4.0.0-beta",
"v4.0.0-alpha",
"v4.0.0-m8",
"v4.0.0-m7",
"v4.0.0-m6",
"v4.0.0-m5",
"v4.0.0-m4",
"v4.0.0-m3",
"v4.0.0-m2",
"v4.0.0-m1",
"v3.2.0-rc6",
"v3.2.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6429.json"
}
}
],
"modified": "2026-10-24T10:30:26.229065398Z",
"provider": "osv",
"references": [
"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:wso2:api_manager:3.2.1:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:api_manager",
"extracted_events": [
{
"range": [
{
"introduced": "3.2.1"
},
{
"last_affected": "3.2.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:wso2:identity_server:5.10.0:*:*:*:*:*:*:*",
"cpe:2.3:a:wso2:identity_server:5.11.0:*:*:*:*:*:*:*",
"cpe:2.3:a:wso2:identity_server:6.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:wso2:identity_server:6.1.0:*:*:*:*:*:*:*",
"cpe:2.3:a:wso2:identity_server:7.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "wso2:identity_server",
"extracted_events": [
{
"range": [
{
"introduced": "5.10.0"
},
{
"last_affected": "5.10.0"
},
{
"introduced": "5.11.0"
},
{
"last_affected": "5.11.0"
},
{
"introduced": "6.0.0"
},
{
"last_affected": "6.0.0"
},
{
"introduced": "6.1.0"
},
{
"last_affected": "6.1.0"
},
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2024-6429",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431567,
"published_at": "2025-09-23T17:15:30.643+00:00"
}