CVE-2024-6429

mediumpriority · track · 0EPSS 0.002 · 12 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.21% (12th) EPSS

CVSS 4.3 · medium

Is it mine?

28 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondaryexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:Nsecondary · OSV

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-451USCWE-451US

affected products (28)

Products and version ranges known to be affected.

WSO2 WSO2 API Managerall versionsenisa_euvdEU
WSO2 WSO2 API Manager3.2.0 → 3.2.0.409enisa_euvdEU
WSO2 WSO2 API Manager3.2.1 → 3.2.1.33enisa_euvdEU
WSO2 WSO2 API Manager4.0.0 → 4.0.0.327enisa_euvdEU
WSO2 WSO2 API Manager4.1.0 → 4.1.0.188enisa_euvdEU
WSO2 WSO2 API Manager4.2.0 → 4.2.0.128enisa_euvdEU
WSO2 WSO2 API Manager4.3.0 → 4.3.0.38enisa_euvdEU
WSO2 WSO2 API Manager4.4.0 → 4.4.0.4enisa_euvdEU
WSO2 WSO2 Identity Serverall versionsenisa_euvdEU
WSO2 WSO2 Identity Server5.10.0 → 5.10.0.314enisa_euvdEU
WSO2 WSO2 Identity Server5.11.0 → 5.11.0.359enisa_euvdEU
WSO2 WSO2 Identity Server6.0.0 → 6.0.0.203enisa_euvdEU
WSO2 WSO2 Identity Server6.1.0 → 6.1.0.176enisa_euvdEU
WSO2 WSO2 Identity Server7.0.0 → 7.0.0.48enisa_euvdEU
WSO2 WSO2 Identity Server as Key Manager5.10.0 → 5.10.0.338enisa_euvdEU
wso2 api manager= 3.2.0nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager= 3.2.1nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager= 4.0.0nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager= 4.1.0nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*
wso2 api manager= 4.2.0nvdUScpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*

showing 20 of 28

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-r6f3-55wj-g9p3WSO2 Identity Server Apps allows content spoofing in logs2025-09-23ghsa · osvUS
A content spoofing issue exists in WSO2 Identity Server Apps, specifically in the Authentication Portal, due to improper handling of authentication error messages. When an authentication failure occurs, the portal previously accepted an `authFailureMsg` value supplied via URL and rendered it in the UI without validating it against the resource bundle. An attacker can craft a link that causes the portal to display attacker-controlled text in the error banner, enabling UI misrepresentation and social-engineering. The fix validates the message key against the resource bundle and encodes input before rendering. Upgrade to `org.wso2.identity.apps:authentication-portal` **2.4.4** or later to remediate.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2025-09-23modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan