CVE-2024-2372Medium· 5.4▾ SunlitThe affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external dom…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.
By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
open_banking_am >= 2.0.0 < 2.0.0.383api_manager >= 3.0.0 < 3.0.0.160api_manager >= 3.1.0 < 3.1.0.335api_manager >= 3.2.0 < 3.2.0.432api_manager >= 3.2.1 < 3.2.1.51api_manager >= 4.0.0 < 4.0.0.310api_manager >= 4.1.0 < 4.1.0.208api_manager >= 4.2.0 < 4.2.0.146api_manager >= 4.3.0 < 4.3.0.59identity_server_as_key_manager >= 5.9.0 < 5.9.0.163identity_server_as_key_manager >= 5.10.0 < 5.10.0.355open_banking_iam >= 2.0.0 < 2.0.0.404enterprise_integrator >= 6.6.0 < 6.6.0.212identity_server >= 5.9.0 < 5.9.0.154identity_server >= 5.10.0 < 5.10.0.291identity_server >= 5.11.0 < 5.11.0.371identity_server >= 6.0.0 < 6.0.0.178identity_server >= 6.1.0 < 6.1.0.134org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.1 < 4.5.1.36org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.3 < 4.5.3.36org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.139org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.1544org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.1 < 4.6.1.105org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.2 < 4.6.2.321org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.3 < 4.6.3.28org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.4 < 4.6.4.11org.wso2.carbon:org.wso2.carbon.registry.core >= 4.7.1 < 4.7.1.47org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.27org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.31org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.0 < 4.9.0.46org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.26 < 4.9.26.18Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-12141Medium· 4.3Open Redirect via Callback URL Validation in WSO2 Products Allows Phishing Attacks
CVE-2024-4989Medium· 5.4Open Redirection via Callback URL in WSO2 API Manager Allows Phishing Attacks
CVE-2026-0637Medium· 5.4Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
CVE-2025-11229High· 7.2Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server
CVE-2026-4052Critical· 9.8Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)
CVE-2025-1397Medium· 4.8Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers