Find a vulnerability

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

2 vulnerabilities found for WSO2 Carbon Identity User Store by WSO2

CVE-2024-4412 (GCVE-0-2024-4412)

Vulnerability from nvd – Published: 2026-10-19 16:59 – Updated: 2026-10-19 16:59

Title

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Summary

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Severity

2.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

WSO2 CNA under the mitre root

CNA scorecard B 89/100 over 48 records in the last 180 days details

References

5 references

URL	Tags
https://security.docs.wso2.com/en/latest/security…	vendor-advisory
https://github.com/wso2-extensions/identity-gover…	patch
https://github.com/wso2/carbon-identity-framework…	patch
https://github.com/wso2/identity-apps/pull/6829	patch
https://github.com/wso2/product-apim/pull/13524	patch

Impacted products

11 products

Vendor	Product	Version
WSO2	WSO2 Enterprise Integrator	Unknown: 0 , < 6.6.0 (custom) Affected: 6.6.0 , < 6.6.0.205 (custom) cpe:2.3:a:wso2:wso2_enterprise_integrator::::::::
WSO2	WSO2 API Manager	Unknown: 0 , < 3.1.0 (custom) Affected: 3.1.0 , < 3.1.0.276 (custom) Affected: 3.2.0 , < 3.2.0.366 (custom) Affected: 3.2.1 , < 3.2.1.18 (custom) Affected: 4.0.0 , < 4.0.0.307 (custom) Affected: 4.1.0 , < 4.1.0.169 (custom) Affected: 4.2.0 , < 4.2.0.108 (custom) Affected: 4.3.0 , < 4.3.0.20 (custom) cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager:::::::: cpe:2.3:a:wso2:wso2_api_manager::::::::
WSO2	WSO2 Open Banking IAM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.346 (custom) cpe:2.3:a:wso2:wso2_open_banking_iam::::::::
WSO2	WSO2 Identity Server	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.297 (custom) Affected: 5.11.0 , < 5.11.0.337 (custom) Affected: 6.0.0 , < 6.0.0.189 (custom) Affected: 6.1.0 , < 6.1.0.149 (custom) Affected: 7.0.0 , < 7.0.0.15 (custom) cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server:::::::: cpe:2.3:a:wso2:wso2_identity_server::::::::
WSO2	WSO2 Identity Server as Key Manager	Unknown: 0 , < 5.10.0 (custom) Affected: 5.10.0 , < 5.10.0.293 (custom) cpe:2.3:a:wso2:wso2_identity_server_as_key_manager::::::::
WSO2	WSO2 Open Banking AM	Unknown: 0 , < 2.0.0 (custom) Affected: 2.0.0 , < 2.0.0.326 (custom) cpe:2.3:a:wso2:wso2_open_banking_am::::::::
WSO2	WSO2 Carbon Identity User Store Configuration UI	Affected: 5.14.127 , < 5.14.127.8 (custom) Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui::::::::
WSO2	WSO2 Carbon Identity User Store Configuration	Affected: 5.14.127 , < 5.14.127.8 (custom) Affected: 5.17.5 , < 5.17.5.266 (custom) Affected: 5.17.118 , < 5.17.118.6 (custom) Affected: 5.18.187 , < 5.18.187.253 (custom) Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.23.8 , < 5.23.8.178 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.92 , < 5.25.92.81 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) Affected: 7.0.78 , < 7.0.78.12 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration::::::::
WSO2	WSO2 Carbon Identity Recovery Management	Affected: 1.4.72 , < 1.4.72.66 (custom) Affected: 1.4.100 , < 1.4.100.6 (custom) Affected: 1.7.2 , < 1.7.2.2 (custom) Affected: 1.8.107 , < 1.8.107.1 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management::::::::
WSO2	WSO2 Carbon Identity Application Authentication Framework	Affected: 5.18.248 , < 5.18.248.20 (custom) Affected: 5.24.8 , < 5.24.8.9 (custom) Affected: 5.25.705 , < 5.25.705.8 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework::::::::
WSO2	WSO2 Carbon Identity User Store	Affected: 1.0.190 , < 1.0.190.14 (custom) Affected: 1.2.3 , < 1.2.3.4 (custom) Affected: 1.2.23 , < 1.2.23.4 (custom) cpe:2.3:a:wso2:wso2_carbon_identity_user_store:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store:::::::: cpe:2.3:a:wso2:wso2_carbon_identity_user_store::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Enterprise Integrator",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "6.6.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.6.0.205",
              "status": "affected",
              "version": "6.6.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 API Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "3.1.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.1.0.276",
              "status": "affected",
              "version": "3.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.0.366",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "3.2.1.18",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "custom"
            },
            {
              "lessThan": "4.0.0.307",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.1.0.169",
              "status": "affected",
              "version": "4.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.2.0.108",
              "status": "affected",
              "version": "4.2.0",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.0.20",
              "status": "affected",
              "version": "4.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking IAM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.346",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.297",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.11.0.337",
              "status": "affected",
              "version": "5.11.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.0.0.189",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "6.1.0.149",
              "status": "affected",
              "version": "6.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.0.15",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Identity Server as Key Manager",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.10.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "5.10.0.293",
              "status": "affected",
              "version": "5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WSO2 Open Banking AM",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "2.0.0",
              "status": "unknown",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.0.0.326",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
          "product": "WSO2 Carbon Identity User Store Configuration UI",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.8",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.266",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.6",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.253",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.178",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.81",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.12",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.user.store.configuration",
          "product": "WSO2 Carbon Identity User Store Configuration",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.14.127.8",
              "status": "affected",
              "version": "5.14.127",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.5.266",
              "status": "affected",
              "version": "5.17.5",
              "versionType": "custom"
            },
            {
              "lessThan": "5.17.118.6",
              "status": "affected",
              "version": "5.17.118",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.187.253",
              "status": "affected",
              "version": "5.18.187",
              "versionType": "custom"
            },
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.23.8.178",
              "status": "affected",
              "version": "5.23.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.92.81",
              "status": "affected",
              "version": "5.25.92",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            },
            {
              "lessThan": "7.0.78.12",
              "status": "affected",
              "version": "7.0.78",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
          "product": "WSO2 Carbon Identity Recovery Management",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.4.72.66",
              "status": "affected",
              "version": "1.4.72",
              "versionType": "custom"
            },
            {
              "lessThan": "1.4.100.6",
              "status": "affected",
              "version": "1.4.100",
              "versionType": "custom"
            },
            {
              "lessThan": "1.7.2.2",
              "status": "affected",
              "version": "1.7.2",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.107.1",
              "status": "affected",
              "version": "1.8.107",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
          "product": "WSO2 Carbon Identity Application Authentication Framework",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "5.18.248.20",
              "status": "affected",
              "version": "5.18.248",
              "versionType": "custom"
            },
            {
              "lessThan": "5.24.8.9",
              "status": "affected",
              "version": "5.24.8",
              "versionType": "custom"
            },
            {
              "lessThan": "5.25.705.8",
              "status": "affected",
              "version": "5.25.705",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
          "product": "WSO2 Carbon Identity User Store",
          "vendor": "WSO2",
          "versions": [
            {
              "lessThan": "1.0.190.14",
              "status": "affected",
              "version": "1.0.190",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.3.4",
              "status": "affected",
              "version": "1.2.3",
              "versionType": "custom"
            },
            {
              "lessThan": "1.2.23.4",
              "status": "affected",
              "version": "1.2.23",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_enterprise_integrator:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.0.205",
                  "versionStartIncluding": "6.6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.1.0.276",
                  "versionStartIncluding": "3.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.0.366",
                  "versionStartIncluding": "3.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.1.18",
                  "versionStartIncluding": "3.2.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.0.0.307",
                  "versionStartIncluding": "4.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.0.169",
                  "versionStartIncluding": "4.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.2.0.108",
                  "versionStartIncluding": "4.2.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_api_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.3.0.20",
                  "versionStartIncluding": "4.3.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_iam:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.346",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.297",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.11.0.337",
                  "versionStartIncluding": "5.11.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.0.189",
                  "versionStartIncluding": "6.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.0.149",
                  "versionStartIncluding": "6.1.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.0.15",
                  "versionStartIncluding": "7.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_identity_server_as_key_manager:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.0.293",
                  "versionStartIncluding": "5.10.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_open_banking_am:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.0.0.326",
                  "versionStartIncluding": "2.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.8",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.266",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.6",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.253",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.178",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.81",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration_ui:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.12",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.14.127.8",
                  "versionStartIncluding": "5.14.127",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.5.266",
                  "versionStartIncluding": "5.17.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.118.6",
                  "versionStartIncluding": "5.17.118",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.187.253",
                  "versionStartIncluding": "5.18.187",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.23.8.178",
                  "versionStartIncluding": "5.23.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.92.81",
                  "versionStartIncluding": "5.25.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store_configuration:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.78.12",
                  "versionStartIncluding": "7.0.78",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.72.66",
                  "versionStartIncluding": "1.4.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.4.100.6",
                  "versionStartIncluding": "1.4.100",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.2.2",
                  "versionStartIncluding": "1.7.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_recovery_management:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.8.107.1",
                  "versionStartIncluding": "1.8.107",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.248.20",
                  "versionStartIncluding": "5.18.248",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.24.8.9",
                  "versionStartIncluding": "5.24.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_application_authentication_framework:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.25.705.8",
                  "versionStartIncluding": "5.25.705",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.0.190.14",
                  "versionStartIncluding": "1.0.190",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2.3.4",
                  "versionStartIncluding": "1.2.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:wso2:wso2_carbon_identity_user_store:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.2.23.4",
                  "versionStartIncluding": "1.2.23",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
            }
          ],
          "value": "The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.\n\nExploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-22",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-22 CAPEC-22: Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T16:59:05.004Z",
        "orgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "shortName": "WSO2"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2-extensions/identity-governance/pull/848"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/carbon-identity-framework/pull/5895"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/identity-apps/pull/6829"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/wso2/product-apim/pull/13524"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: transparent;\"\u003eFollow the instructions given on \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\"\u003e\u003cspan style=\"background-color: transparent;\"\u003ehttps://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution\u003c/span\u003e\u003c/a\u003e \u003cbr\u003e"
            }
          ],
          "value": "Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/#solution"
        }
      ],
      "source": {
        "advisory": "WSO2-2023-3098",
        "discovery": "INTERNAL"
      },
      "title": "Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
    "assignerShortName": "WSO2",
    "cveId": "CVE-2024-4412",
    "datePublished": "2026-10-19T16:59:05.004Z",
    "dateReserved": "2024-05-02T08:55:58.638Z",
    "dateUpdated": "2026-10-19T16:59:05.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}