CVE-2024-4989

Awaiting Analysis Awaiting Analysis - Queue

Open Redirect Vulnerability in WSO2 API Manager

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: WSO2 LLC

Description

The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2024-4989

EUVD

EUVD-2024-55811

Affected Vendors & Products

Vendor	Product	Version / Range
WSO2	WSO2 API Manager	4.1.0
WSO2	WSO2 API Manager	4.2.0
WSO2	WSO2 API Manager	4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

The vulnerability in WSO2 API Manager involves a callback URL parameter that does not properly validate user input. This allows attackers to manipulate the parameter to redirect users to malicious websites. The flaw can be exploited through social engineering to trick users into visiting harmful links, potentially leading to phishing attacks or unauthorized access to sensitive data.

Impact Analysis

This vulnerability could allow attackers to redirect you to fake websites designed to steal your login credentials or other sensitive information. You might unknowingly provide personal data or download malware if you interact with these malicious links. The risk is higher if you use WSO2 API Manager in your environment.

Compliance Impact

This vulnerability could lead to phishing attacks by redirecting users to attacker-controlled pages, potentially exposing sensitive data. This may violate GDPR's requirement for protecting personal data and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Apply the latest security patches or updates provided by WSO2 for API Manager to address the callback URL validation issue. Monitor official WSO2 advisories for patches.

Hi! I’m here to help you understand CVE-2024-4989. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...