Vulnerability · Published Aug 6, 2026 · Assigned by WSO2
CVE-2024-6541Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
Medium 6.8
In plain English
A medium-severity improper input validation in WSO2 API Manager from WSO2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Official description
The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WSO2 | WSO2 Micro Integrator | 1.2.0 – before 1.2.0.1634.1.0 – before 4.1.0.1034.3.0 – before 4.3.0.7 |
| WSO2 | WSO2 Enterprise Integrator | 6.6.0 – before 6.6.0.205 |
| WSO2 | WSO2 API Manager | 3.2.0 – before 3.2.0.3943.2.1 – before 3.2.1.214.0.0 – before 4.0.0.3114.1.0 – before 4.1.0.1674.2.0 – before 4.2.0.1104.3.0 – before 4.3.0.24 |
| WSO2 | WSO2-Synapse | 2.1.7.wso2v182 – before 2.1.7.wso2v182_932.1.7.wso2v143 – before 2.1.7.wso2v143_1192.1.7.wso2v183 – before 2.1.7.wso2v183_622.1.7.wso2v319 – before 2.1.7.wso2v319_72.1.7.wso2v227 – before 2.1.7.wso2v227_882.1.7.wso2v271 – before 2.1.7.wso2v271_604.0.0.wso2v119 – before 4.0.0.wso2v119_34.0.0.wso2v105 – before 4.0.0.wso2v105_3 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N