Skip to content
CVE Tracker
Back

CVE-2024-12139

Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social Engineering Attacks

Medium4.3
Published
Updated
Reserved
Assigned by
WSO2

Description

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.

Scores

CVSS scores of CVE-2024-12139, by who scored it
Scored byCVSSScoreVector
WSO2CNA (assigner)3.1Medium4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVDNVD · Awaiting Analysis3.1Medium4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

Affected products

  • WSO2 · WSO2 API Manager

    • unknown < 3.2.1
    • affected 3.2.1 – < 3.2.1.49
    • affected 4.1.0 – < 4.1.0.210
    • affected 4.2.0 – < 4.2.0.148

  • WSO2 · WSO2 Identity Server

    • unknown < 5.10.0
    • affected 5.10.0 – < 5.10.0.346
    • affected 5.11.0 – < 5.11.0.385
    • affected 6.0.0 – < 6.0.0.229

  • WSO2 · WSO2 Identity Server as Key Manager

    • unknown < 5.10.0
    • affected 5.10.0 – < 5.10.0.339

What to do

Solution: Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .