{"id":"CVE-2024-2372","title":"Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows Phishing Attacks","summary":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external dom…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-601"],"vendor":"WSO2","product":"WSO2 Open Banking AM","affected":["open_banking_am >= 2.0.0 < 2.0.0.383","api_manager >= 3.0.0 < 3.0.0.160","api_manager >= 3.1.0 < 3.1.0.335","api_manager >= 3.2.0 < 3.2.0.432","api_manager >= 3.2.1 < 3.2.1.51","api_manager >= 4.0.0 < 4.0.0.310","api_manager >= 4.1.0 < 4.1.0.208","api_manager >= 4.2.0 < 4.2.0.146","api_manager >= 4.3.0 < 4.3.0.59","identity_server_as_key_manager >= 5.9.0 < 5.9.0.163","identity_server_as_key_manager >= 5.10.0 < 5.10.0.355","open_banking_iam >= 2.0.0 < 2.0.0.404","enterprise_integrator >= 6.6.0 < 6.6.0.212","identity_server >= 5.9.0 < 5.9.0.154","identity_server >= 5.10.0 < 5.10.0.291","identity_server >= 5.11.0 < 5.11.0.371","identity_server >= 6.0.0 < 6.0.0.178","identity_server >= 6.1.0 < 6.1.0.134","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.1 < 4.5.1.36","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.3 < 4.5.3.36","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.139","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.1544","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.1 < 4.6.1.105","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.2 < 4.6.2.321","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.3 < 4.6.3.28","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.4 < 4.6.4.11","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.7.1 < 4.7.1.47","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.27","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.31","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.0 < 4.9.0.46","org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.26 < 4.9.26.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T16:56:50.364469Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T16:57:01.300Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-2372","references":[{"url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/"}],"tags":["cve.org"],"epss":0.00198,"epssPercentile":0.09679,"ingestedAt":"2026-11-05T19:30:42.716Z","slug":"CVE-2024-2372","body":"## Overview\n\nThe affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.\n\n## Affected\n\n- `open_banking_am >= 2.0.0 < 2.0.0.383`\n- `api_manager >= 3.0.0 < 3.0.0.160`\n- `api_manager >= 3.1.0 < 3.1.0.335`\n- `api_manager >= 3.2.0 < 3.2.0.432`\n- `api_manager >= 3.2.1 < 3.2.1.51`\n- `api_manager >= 4.0.0 < 4.0.0.310`\n- `api_manager >= 4.1.0 < 4.1.0.208`\n- `api_manager >= 4.2.0 < 4.2.0.146`\n- `api_manager >= 4.3.0 < 4.3.0.59`\n- `identity_server_as_key_manager >= 5.9.0 < 5.9.0.163`\n- `identity_server_as_key_manager >= 5.10.0 < 5.10.0.355`\n- `open_banking_iam >= 2.0.0 < 2.0.0.404`\n- `enterprise_integrator >= 6.6.0 < 6.6.0.212`\n- `identity_server >= 5.9.0 < 5.9.0.154`\n- `identity_server >= 5.10.0 < 5.10.0.291`\n- `identity_server >= 5.11.0 < 5.11.0.371`\n- `identity_server >= 6.0.0 < 6.0.0.178`\n- `identity_server >= 6.1.0 < 6.1.0.134`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.1 < 4.5.1.36`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.3 < 4.5.3.36`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.139`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.1544`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.1 < 4.6.1.105`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.2 < 4.6.2.321`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.3 < 4.6.3.28`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.4 < 4.6.4.11`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.7.1 < 4.7.1.47`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.27`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.31`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.0 < 4.9.0.46`\n- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.26 < 4.9.26.18`\n\n## Remediation\n\nFollow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}