---
id: CVE-2024-12139
title: >-
  Content Spoofing via Error Handling in Multiple WSO2 Products Enables Social
  Engineering Attacks
summary: >-
  The error handling implementation fails to properly sanitize or validate
  user-supplied input within URL parameters under specific conditions. This
  allows end-users to manipulate the error messages that are displayed by the
  application.


  …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
vendor: WSO2
product: WSO2 API Manager
affected:
  - api_manager >= 3.2.1 < 3.2.1.49
  - api_manager >= 4.1.0 < 4.1.0.210
  - api_manager >= 4.2.0 < 4.2.0.148
  - identity_server >= 5.10.0 < 5.10.0.346
  - identity_server >= 5.11.0 < 5.11.0.385
  - identity_server >= 6.0.0 < 6.0.0.229
  - identity_server_as_key_manager >= 5.10.0 < 5.10.0.339
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T19:09:36.270401Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T19:10:02.263Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-12139'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/
tags:
  - cve.org
epss: 0.00214
epssPercentile: 0.11791
ingestedAt: '2026-11-05T19:30:42.786Z'
---

## Overview

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application.

By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.

## Affected

- `api_manager >= 3.2.1 < 3.2.1.49`
- `api_manager >= 4.1.0 < 4.1.0.210`
- `api_manager >= 4.2.0 < 4.2.0.148`
- `identity_server >= 5.10.0 < 5.10.0.346`
- `identity_server >= 5.11.0 < 5.11.0.385`
- `identity_server >= 6.0.0 < 6.0.0.229`
- `identity_server_as_key_manager >= 5.10.0 < 5.10.0.339`

## Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3805/#solution