CVE-2024-4412

🗓️ 19 Oct 2026 16:59:05Reported by WSO2Type

Expression Language Injection in multiple WSO2 products permits arbitrary operations.

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2024-4412	19 Oct 202617:07	–	circl
CNNVD	WSO2 Enterprise Integrator code injection vulnerability	18 Oct 202616:00	–	cnnvd
Cvelist	CVE-2024-4412 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations	19 Oct 202616:59	–	cvelist
EUVD	EUVD-2024-55807	19 Oct 202616:59	–	euvd
NVD	CVE-2024-4412	19 Oct 202617:16	–	nvd
Positive Technologies	PT-2026-117485	19 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-4412: Improper Control of Generation of Code	19 Oct 202600:00	–	rapid7
Vulnrichment	CVE-2024-4412 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations	19 Oct 202616:59	–	vulnrichment

Vulners

CNA

Node

wso2 enterprise_integratorRange6.6.0–6.6.0.205

wso2 api_managerRange3.1.0–3.1.0.276

wso2 api_managerRange3.2.0–3.2.0.366

wso2 api_managerRange3.2.1–3.2.1.18

wso2 api_managerRange4.0.0–4.0.0.307

wso2 api_managerRange4.1.0–4.1.0.169

wso2 api_managerRange4.2.0–4.2.0.108

wso2 api_managerRange4.3.0–4.3.0.20

wso2 open_banking_iamRange2.0.0–2.0.0.346

wso2 identity_serverRange5.10.0–5.10.0.297

wso2 identity_serverRange5.11.0–5.11.0.337

wso2 identity_serverRange6.0.0–6.0.0.189

wso2 identity_serverRange6.1.0–6.1.0.149

wso2 identity_serverRange7.0.0–7.0.0.15

wso2 identity_server_as_key_managerRange5.10.0–5.10.0.293

wso2 open_banking_amRange2.0.0–2.0.0.326

[
  {
    "vendor": "WSO2",
    "product": "WSO2 Enterprise Integrator",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "6.6.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.6.0",
        "lessThan": "6.6.0.205",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 API Manager",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "3.1.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.1.0",
        "lessThan": "3.1.0.276",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.2.0",
        "lessThan": "3.2.0.366",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "3.2.1",
        "lessThan": "3.2.1.18",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.0.0",
        "lessThan": "4.0.0.307",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.1.0",
        "lessThan": "4.1.0.169",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.2.0",
        "lessThan": "4.2.0.108",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "4.3.0",
        "lessThan": "4.3.0.20",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Open Banking IAM",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "2.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.0.346",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.297",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.11.0",
        "lessThan": "5.11.0.337",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.0.0",
        "lessThan": "6.0.0.189",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "6.1.0",
        "lessThan": "6.1.0.149",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.0",
        "lessThan": "7.0.0.15",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Identity Server as Key Manager",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "5.10.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.10.0",
        "lessThan": "5.10.0.293",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Open Banking AM",
    "versions": [
      {
        "status": "unknown",
        "version": "0",
        "lessThan": "2.0.0",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.0.326",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity User Store Configuration UI",
    "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui",
    "versions": [
      {
        "status": "affected",
        "version": "5.14.127",
        "lessThan": "5.14.127.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.5",
        "lessThan": "5.17.5.266",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.118",
        "lessThan": "5.17.118.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.187",
        "lessThan": "5.18.187.253",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.248",
        "lessThan": "5.18.248.20",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.23.8",
        "lessThan": "5.23.8.178",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.24.8",
        "lessThan": "5.24.8.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.92",
        "lessThan": "5.25.92.81",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.705",
        "lessThan": "5.25.705.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.78",
        "lessThan": "7.0.78.12",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity User Store Configuration",
    "packageName": "org.wso2.carbon.identity.user.store.configuration",
    "versions": [
      {
        "status": "affected",
        "version": "5.14.127",
        "lessThan": "5.14.127.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.5",
        "lessThan": "5.17.5.266",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.17.118",
        "lessThan": "5.17.118.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.187",
        "lessThan": "5.18.187.253",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.18.248",
        "lessThan": "5.18.248.20",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.23.8",
        "lessThan": "5.23.8.178",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.24.8",
        "lessThan": "5.24.8.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.92",
        "lessThan": "5.25.92.81",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.705",
        "lessThan": "5.25.705.8",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "7.0.78",
        "lessThan": "7.0.78.12",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity Recovery Management",
    "packageName": "org.wso2.carbon.identity.governance:org.wso2.carbon.identity.recovery",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.72",
        "lessThan": "1.4.72.66",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.4.100",
        "lessThan": "1.4.100.6",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.7.2",
        "lessThan": "1.7.2.2",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.8.107",
        "lessThan": "1.8.107.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity Application Authentication Framework",
    "packageName": "org.wso2.carbon.identity.framework:org.wso2.carbon.identity.application.authentication.framework",
    "versions": [
      {
        "status": "affected",
        "version": "5.18.248",
        "lessThan": "5.18.248.20",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.24.8",
        "lessThan": "5.24.8.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "5.25.705",
        "lessThan": "5.25.705.8",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "WSO2",
    "product": "WSO2 Carbon Identity User Store",
    "packageName": "org.wso2.carbon.identity.api.server.userstore.v1",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.190",
        "lessThan": "1.0.190.14",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.2.3",
        "lessThan": "1.2.3.4",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.2.23",
        "lessThan": "1.2.23.4",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
github	www.github.com/wso2-extensions/identity-governance/pull/848
github	www.github.com/wso2/product-apim/pull/13524
github	www.github.com/wso2/identity-apps/pull/6829
github	www.github.com/wso2/carbon-identity-framework/pull/5895
security	www.security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/

27 Oct 2026 19:10Current

6.3Medium risk

Vulners AI Score6.3

CVSS 3.12.7

EPSS0.00369

CWE-94