CVE-2024-4412: Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Severity: low (CVSS 2.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-27
Weakness: CWE-94

Description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Affected products

WSO2 API Manager: from 3.1.0 before 3.1.0.276; from 3.2.0 before 3.2.0.366; from 3.2.1 before 3.2.1.18; from 4.0.0 before 4.0.0.307; from 4.1.0 before 4.1.0.169; from 4.2.0 before 4.2.0.108 — fixed in 3.1.0.276, 3.2.0.366, 3.2.1.18, 4.0.0.307, 4.1.0.169, 4.2.0.108
WSO2 Enterprise Integrator: from 6.6.0 before 6.6.0.205 — fixed in 6.6.0.205
WSO2 Identity Server: from 5.10.0 before 5.10.0.297; from 5.11.0 before 5.11.0.337; from 6.0.0 before 6.0.0.189; from 6.1.0 before 6.1.0.149; from 7.0.0 before 7.0.0.15 — fixed in 5.10.0.297, 5.11.0.337, 6.0.0.189, 6.1.0.149, 7.0.0.15
WSO2 Carbon Identity Application Authentication Framework: from 5.18.248 before 5.18.248.20; from 5.24.8 before 5.24.8.9; from 5.25.705 before 5.25.705.8 — fixed in 5.18.248.20, 5.24.8.9, 5.25.705.8
WSO2 Carbon Identity Recovery Management: from 1.4.72 before 1.4.72.66; from 1.4.100 before 1.4.100.6; from 1.7.2 before 1.7.2.2; from 1.8.107 before 1.8.107.1 — fixed in 1.4.100.6, 1.4.72.66, 1.7.2.2, 1.8.107.1
WSO2 Carbon Identity User Store: from 1.0.190 before 1.0.190.14; from 1.2.3 before 1.2.3.4; from 1.2.23 before 1.2.23.4 — fixed in 1.0.190.14, 1.2.23.4, 1.2.3.4
WSO2 Carbon Identity User Store Configuration: from 5.14.127 before 5.14.127.8; from 5.17.5 before 5.17.5.266; from 5.17.118 before 5.17.118.6; from 5.18.187 before 5.18.187.253; from 5.18.248 before 5.18.248.20; from 5.23.8 before 5.23.8.178 — fixed in 5.14.127.8, 5.17.118.6, 5.17.5.266, 5.18.187.253, 5.18.248.20, 5.23.8.178
WSO2 Carbon Identity User Store Configuration UI: from 5.14.127 before 5.14.127.8; from 5.17.5 before 5.17.5.266; from 5.17.118 before 5.17.118.6; from 5.18.187 before 5.18.187.253; from 5.18.248 before 5.18.248.20; from 5.23.8 before 5.23.8.178 — fixed in 5.14.127.8, 5.17.118.6, 5.17.5.266, 5.18.187.253, 5.18.248.20, 5.23.8.178
WSO2 Identity Server as Key Manager: from 5.10.0 before 5.10.0.293 — fixed in 5.10.0.293
WSO2 Open Banking AM: from 2.0.0 before 2.0.0.326 — fixed in 2.0.0.326
WSO2 Open Banking IAM: from 2.0.0 before 2.0.0.346 — fixed in 2.0.0.346

How to fix

Upgrade to a fixed version: WSO2 API Manager 3.1.0.276, 3.2.0.366, 3.2.1.18, 4.0.0.307; WSO2 Enterprise Integrator 6.6.0.205; WSO2 Identity Server 5.10.0.297, 5.11.0.337, 6.0.0.189, 6.1.0.149; WSO2 Carbon Identity Application Authentication Framework 5.18.248.20, 5.24.8.9, 5.25.705.8; WSO2 Carbon Identity Recovery Management 1.4.100.6, 1.4.72.66, 1.7.2.2, 1.8.107.1; WSO2 Carbon Identity User Store 1.0.190.14, 1.2.23.4, 1.2.3.4; WSO2 Carbon Identity User Store Configuration 5.14.127.8, 5.17.118.6, 5.17.5.266, 5.18.187.253; WSO2 Carbon Identity User Store Configuration UI 5.14.127.8, 5.17.118.6, 5.17.5.266, 5.18.187.253; WSO2 Identity Server as Key Manager 5.10.0.293; WSO2 Open Banking AM 2.0.0.326; WSO2 Open Banking IAM 2.0.0.346. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-4412 or the next vulnerability affects your stack