CVE-2024-10242
Reflected XSS in Authentication Endpoint Allows Browser Manipulation
Publication date: 2026-04-16
Last updated on: 2026-04-23
Assigner: WSO2 LLC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wso2 | api_manager | From 3.2.0 (inc) to 3.2.0.401 (exc) |
| wso2 | api_manager | From 4.0.0 (inc) to 4.0.0.318 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can allow an attacker to redirect the user's browser to a malicious website, modify the user interface of the web page, or retrieve information from the browser.
However, the impact is somewhat limited because session-related sensitive cookies are protected by the httpOnly flag, which prevents session hijacking.
Can you explain this vulnerability to me?
This vulnerability occurs because the authentication endpoint does not properly validate user-supplied input before reflecting it back in the response.
As a result, an attacker can inject malicious script payloads into the input parameters, which are then executed by the victim's browser.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker to inject malicious scripts that can be executed in a victim's browser, potentially leading to unauthorized access to information displayed or processed by the web application.
While session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking, the ability to modify the UI or redirect users to malicious sites could still lead to exposure of personal data or manipulation of user interactions.
Such risks may impact compliance with standards like GDPR and HIPAA, which require protection of personal data and secure user interactions, as exploitation could lead to unauthorized disclosure or alteration of data.
However, the description does not explicitly state the direct compliance impact or whether any personal data is compromised, so the exact effect on compliance depends on the context of data handled by the affected system.