CVE-2024-4598

mediumpriority · track · 0EPSS 0.003 · 26 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.33% (26th) EPSS

CVSS 6.5 · medium

Is it mine?

14 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-26

An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions. This vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 2.8 · impact 3.6

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1259US

affected products (14)

Products and version ranges known to be affected.

WSO2 WSO2 API Managerall versionsenisa_euvdEU
WSO2 WSO2 API Manager3.2.0 → 3.2.0.422enisa_euvdEU
WSO2 WSO2 API Manager3.2.1 → 3.2.1.42enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.152enisa_euvdEU
WSO2 WSO2 API Manager4.3.0 → 4.3.0.55enisa_euvdEU
WSO2 WSO2 Micro Integratorall versionsenisa_euvdEU
WSO2 WSO2 Micro Integrator1.2.0 → 1.2.0.157enisa_euvdEU
WSO2 WSO2 Micro Integrator4.1.0 → 4.1.0.95enisa_euvdEU
wso2 api manager3.2.0 → 3.2.0.422nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager3.2.1 → 3.2.1.42nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.1.0 → 4.1.0.152nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager4.3.0 → 4.3.0.55nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 micro integrator1.2.0 → 1.2.0.157nvdUScpe:2.3:a:wso2:micro_integrator:*:*:*:*:*:*:*:*
wso2 micro integrator4.1.0 → 4.1.0.95nvdUScpe:2.3:a:wso2:micro_integrator:*:*:*:*:*:*:*:*

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2025-09-23modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan