---
id: CVE-2024-2372
title: >-
  Open Redirection via Unsanitized User Input in Multiple WSO2 Products Allows
  Phishing Attacks
summary: >-
  The affected components accept user-supplied input for constructing
  redirection URLs without enforcing expected validation constraints. This
  allows an attacker to provide a crafted URL that can redirect users to an
  arbitrary external dom…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-601
vendor: WSO2
product: WSO2 Open Banking AM
affected:
  - open_banking_am >= 2.0.0 < 2.0.0.383
  - api_manager >= 3.0.0 < 3.0.0.160
  - api_manager >= 3.1.0 < 3.1.0.335
  - api_manager >= 3.2.0 < 3.2.0.432
  - api_manager >= 3.2.1 < 3.2.1.51
  - api_manager >= 4.0.0 < 4.0.0.310
  - api_manager >= 4.1.0 < 4.1.0.208
  - api_manager >= 4.2.0 < 4.2.0.146
  - api_manager >= 4.3.0 < 4.3.0.59
  - identity_server_as_key_manager >= 5.9.0 < 5.9.0.163
  - identity_server_as_key_manager >= 5.10.0 < 5.10.0.355
  - open_banking_iam >= 2.0.0 < 2.0.0.404
  - enterprise_integrator >= 6.6.0 < 6.6.0.212
  - identity_server >= 5.9.0 < 5.9.0.154
  - identity_server >= 5.10.0 < 5.10.0.291
  - identity_server >= 5.11.0 < 5.11.0.371
  - identity_server >= 6.0.0 < 6.0.0.178
  - identity_server >= 6.1.0 < 6.1.0.134
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.1 < 4.5.1.36'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.3 < 4.5.3.36'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.139'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.1544'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.1 < 4.6.1.105'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.2 < 4.6.2.321'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.3 < 4.6.3.28'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.4 < 4.6.4.11'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.7.1 < 4.7.1.47'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.27'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.31'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.0 < 4.9.0.46'
  - 'org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.26 < 4.9.26.18'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T16:56:50.364469Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T16:57:01.300Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-2372'
references:
  - url: >-
      https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/
tags:
  - cve.org
epss: 0.00198
epssPercentile: 0.09679
ingestedAt: '2026-11-05T19:30:42.716Z'
---

## Overview

The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.

By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.

## Affected

- `open_banking_am >= 2.0.0 < 2.0.0.383`
- `api_manager >= 3.0.0 < 3.0.0.160`
- `api_manager >= 3.1.0 < 3.1.0.335`
- `api_manager >= 3.2.0 < 3.2.0.432`
- `api_manager >= 3.2.1 < 3.2.1.51`
- `api_manager >= 4.0.0 < 4.0.0.310`
- `api_manager >= 4.1.0 < 4.1.0.208`
- `api_manager >= 4.2.0 < 4.2.0.146`
- `api_manager >= 4.3.0 < 4.3.0.59`
- `identity_server_as_key_manager >= 5.9.0 < 5.9.0.163`
- `identity_server_as_key_manager >= 5.10.0 < 5.10.0.355`
- `open_banking_iam >= 2.0.0 < 2.0.0.404`
- `enterprise_integrator >= 6.6.0 < 6.6.0.212`
- `identity_server >= 5.9.0 < 5.9.0.154`
- `identity_server >= 5.10.0 < 5.10.0.291`
- `identity_server >= 5.11.0 < 5.11.0.371`
- `identity_server >= 6.0.0 < 6.0.0.178`
- `identity_server >= 6.1.0 < 6.1.0.134`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.1 < 4.5.1.36`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.5.3 < 4.5.3.36`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.139`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.0 < 4.6.0.1544`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.1 < 4.6.1.105`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.2 < 4.6.2.321`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.3 < 4.6.3.28`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.6.4 < 4.6.4.11`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.7.1 < 4.7.1.47`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.27`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.8.1 < 4.8.1.31`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.0 < 4.9.0.46`
- `org.wso2.carbon:org.wso2.carbon.registry.core >= 4.9.26 < 4.9.26.18`

## Remediation

Follow the instructions given on https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/#solution