Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by WSO2

CVE-2024-4412Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Low 2.7

In plain English

A low-severity code injection in WSO2 API Manager from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Affected products (as reported)

VendorProductVersions
WSO2 WSO2 Enterprise Integrator 6.6.0 – before 6.6.0.205
WSO2 WSO2 API Manager 3.1.0 – before 3.1.0.2763.2.0 – before 3.2.0.3663.2.1 – before 3.2.1.184.0.0 – before 4.0.0.3074.1.0 – before 4.1.0.1694.2.0 – before 4.2.0.1084.3.0 – before 4.3.0.20
WSO2 WSO2 Open Banking IAM 2.0.0 – before 2.0.0.346
WSO2 WSO2 Identity Server 5.10.0 – before 5.10.0.2975.11.0 – before 5.11.0.3376.0.0 – before 6.0.0.1896.1.0 – before 6.1.0.1497.0.0 – before 7.0.0.15
WSO2 WSO2 Identity Server as Key Manager 5.10.0 – before 5.10.0.293
WSO2 WSO2 Open Banking AM 2.0.0 – before 2.0.0.326
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.14.127 – before 5.14.127.85.17.5 – before 5.17.5.2665.17.118 – before 5.17.118.65.18.187 – before 5.18.187.2535.18.248 – before 5.18.248.205.23.8 – before 5.23.8.1785.24.8 – before 5.24.8.95.25.92 – before 5.25.92.81
WSO2 WSO2 Carbon Identity User Store Configuration 5.14.127 – before 5.14.127.85.17.5 – before 5.17.5.2665.17.118 – before 5.17.118.65.18.187 – before 5.18.187.2535.18.248 – before 5.18.248.205.23.8 – before 5.23.8.1785.24.8 – before 5.24.8.95.25.92 – before 5.25.92.81
WSO2 WSO2 Carbon Identity Recovery Management 1.4.72 – before 1.4.72.661.4.100 – before 1.4.100.61.7.2 – before 1.7.2.21.8.107 – before 1.8.107.1
WSO2 WSO2 Carbon Identity Application Authentication Framework 5.18.248 – before 5.18.248.205.24.8 – before 5.24.8.95.25.705 – before 5.25.705.8
WSO2 WSO2 Carbon Identity User Store 1.0.190 – before 1.0.190.141.2.3 – before 1.2.3.41.2.23 – before 1.2.23.4

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References