CVE-2024-6423
Received
Received - Intake
Improper Input Validation in URL Parameters Leading to Sensitive Data Exposure
Vulnerability report for CVE-2024-6423, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: WSO2 LLC
Description
Description
The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.
If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| WSO2 | WSO2 | API Manager 3.1.0 |
| WSO2 | WSO2 | API Manager 3.2.0 |
| WSO2 | WSO2 | API Manager 3.2.1 |
| WSO2 | WSO2 | API Manager 4.0.0 |
| WSO2 | WSO2 | API Manager 4.1.0 |
| WSO2 | WSO2 | API Manager 4.2.0 |
| WSO2 | WSO2 | API Manager 4.3.0 |
| WSO2 | WSO2 | API Manager 4.4.0 |
| WSO2 | WSO2 | Open Banking AM 2.0.0 |
| WSO2 | WSO2 | Identity Server 5.10.0 |
| WSO2 | WSO2 | Identity Server 5.11.0 |
| WSO2 | WSO2 | Identity Server 6.0.0 |
| WSO2 | WSO2 | Identity Server 6.1.0 |
| WSO2 | WSO2 | Identity Server 7.0.0 |
| WSO2 | WSO2 | Identity Server as Key Manager 5.10.0 |
| WSO2 | WSO2 | Open Banking IAM 2.0.0 |
| WSO2 | WSO2 | Carbon Identity Application 6.3.0 |
| WSO2 | WSO2 | Carbon Identity Application 6.3.11 |
| WSO2 | WSO2 | Carbon Identity Application 6.3.58 |
| WSO2 | WSO2 | Carbon Identity Application 6.5.0 |
| WSO2 | WSO2 | Carbon Identity Application 6.6.0 |
| WSO2 | WSO2 | Carbon Identity Application 6.7.8 |
| WSO2 | WSO2 | Carbon Identity Application 6.7.32 |
| WSO2 | WSO2 | Carbon Identity Core 5.17.5 |
| WSO2 | WSO2 | Carbon Identity Core 5.17.118 |
| WSO2 | WSO2 | Carbon Identity Core 5.18.187 |
| WSO2 | WSO2 | Carbon Identity Core 5.18.248 |
| WSO2 | WSO2 | Carbon Identity Core 5.23.8 |
| WSO2 | WSO2 | Carbon Identity Core 5.24.8 |
| WSO2 | WSO2 | Carbon Identity Core 5.25.92 |
| WSO2 | WSO2 | Carbon Identity Core 5.25.92 |
| WSO2 | WSO2 | Carbon Identity Core 5.25.705 |
| WSO2 | WSO2 | Carbon Identity Core 5.25.713 |
| WSO2 | WSO2 | Carbon Identity Core 7.0.78 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.4.2 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.4.176 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.4.180 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.8.0 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.9.6 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.11.21 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.13.16 |
| WSO2 | WSO2 | Carbon Identity Oauth 6.13.19 |
| WSO2 | WSO2 | Carbon Identity Oauth 7.0.26 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
