CVE-2024-4412
Awaiting Analysis Awaiting Analysis - Queue

Expression Language Injection in Apache Tomcat

Publication date: 2026-10-19

Last updated on: 2026-10-27

Assigner: WSO2 LLC

Description
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-27
Generated
2026-11-08
AI Q&A
2026-10-19
EPSS Evaluated
2026-11-07
NVD
CVE-2024-4412
EUVD
EUVD-2024-55807

Affected Vendors & Products

Showing 46 associated CPEs
Vendor Product Version / Range
WSO2 WSO2 Enterprise Integrator 6.6.0
WSO2 WSO2 API Manager 3.1.0
WSO2 WSO2 API Manager 3.2.0
WSO2 WSO2 API Manager 3.2.1
WSO2 WSO2 API Manager 4.0.0
WSO2 WSO2 API Manager 4.1.0
WSO2 WSO2 API Manager 4.2.0
WSO2 WSO2 API Manager 4.3.0
WSO2 WSO2 Open Banking IAM 2.0.0
WSO2 WSO2 Identity Server 5.10.0
WSO2 WSO2 Identity Server 5.11.0
WSO2 WSO2 Identity Server 6.0.0
WSO2 WSO2 Identity Server 6.1.0
WSO2 WSO2 Identity Server 7.0.0
WSO2 WSO2 Identity Server as Key Manager 5.10.0
WSO2 WSO2 Open Banking AM 2.0.0
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.14.127
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.17.5
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.17.118
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.18.187
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.18.248
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.23.8
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.24.8
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.25.92
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.25.705
WSO2 WSO2 Carbon Identity User Store Configuration UI 7.0.78
WSO2 WSO2 Carbon Identity User Store Configuration 5.14.127
WSO2 WSO2 Carbon Identity User Store Configuration 5.17.5
WSO2 WSO2 Carbon Identity User Store Configuration 5.17.118
WSO2 WSO2 Carbon Identity User Store Configuration 5.18.187
WSO2 WSO2 Carbon Identity User Store Configuration 5.18.248
WSO2 WSO2 Carbon Identity User Store Configuration 5.23.8
WSO2 WSO2 Carbon Identity User Store Configuration 5.24.8
WSO2 WSO2 Carbon Identity User Store Configuration 5.25.92
WSO2 WSO2 Carbon Identity User Store Configuration 5.25.705
WSO2 WSO2 Carbon Identity User Store Configuration 7.0.78
WSO2 WSO2 Carbon Identity Recovery Management 1.4.72
WSO2 WSO2 Carbon Identity Recovery Management 1.4.100
WSO2 WSO2 Carbon Identity Recovery Management 1.7.2
WSO2 WSO2 Carbon Identity Recovery Management 1.8.107
WSO2 WSO2 Carbon Identity Application Authentication Framework 5.18.248
WSO2 WSO2 Carbon Identity Application Authentication Framework 5.24.8
WSO2 WSO2 Carbon Identity Application Authentication Framework 5.25.705
WSO2 WSO2 Carbon Identity User Store 1.0.190
WSO2 WSO2 Carbon Identity User Store 1.2.3
WSO2 WSO2 Carbon Identity User Store 1.2.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper handling of user-supplied data in WSO2 products, allowing malicious Expression Language (EL) code injection. Exploitation requires administrator privileges and is limited to certain read operations, minimizing impact.

Detection Guidance

Detection requires checking for improper email domain handling during user provisioning in WSO2 Identity Apps, Carbon Identity Framework, API Manager, or Identity Governance. Review logs for failed self-registration attempts or mismatched tenant domains in usernames. Validate if 'EmailUserName' feature is enabled and monitor for dropped email domains during JIT provisioning.

Impact Analysis

The vulnerability primarily affects WSO2 Identity Apps, API Manager, and Identity Server products. It can lead to incorrect email domain handling during user provisioning, potentially causing account issues or improper userstore validations.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it requires administrator privileges and has minimal impact due to restricted EL usage. Compliance risks would depend on how the affected WSO2 products are implemented in a regulated environment.

Mitigation Strategies

Apply the latest patches from WSO2 for affected products like Identity Apps, Carbon Identity Framework, API Manager, and Identity Governance. Review and update configurations to ensure proper email domain handling during user provisioning and validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-4412. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...