Strix
74.2K

CVE-2024-12139

MEDIUMCVSS 4.3/10

Last modified

CVE-2024-12139 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages.

Description

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.

Metrics

CVSS 3.1
4.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
WSO2WSO2 API Manager< 3.2.1; >= 3.2.1, < 3.2.1.49; >= 4.1.0, < 4.1.0.210; >= 4.2.0, < 4.2.0.148
WSO2WSO2 Identity Server< 5.10.0; >= 5.10.0, < 5.10.0.346; >= 5.11.0, < 5.11.0.385; >= 6.0.0, < 6.0.0.229
WSO2WSO2 Identity Server as Key Manager< 5.10.0; >= 5.10.0, < 5.10.0.339

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2024-12139?
The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate the error messages that are displayed by the application. By exploiting this vulnerability, malicious actors can inject arbitrary content into error messages. This enables them to perform social engineering attacks, such as phishing or credential theft, by replacing legitimate error messages with malicious content, misleading users into compromising sensitive information or taking harmful actions.
How severe is CVE-2024-12139?
CVE-2024-12139 has a CVSS score of 4.3/10 (MEDIUM severity).
How do I fix CVE-2024-12139?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2024

View all 2024CVEs →

Are you affected by CVE-2024-12139?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST