Strix
74.1K

CVE-2024-2372

MEDIUMCVSS 5.4/10

Last modified

CVE-2024-2372 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page.

Description

The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.

Metrics

CVSS 3.1
5.4/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
WSO2WSO2 Open Banking AM< 2.0.0; >= 2.0.0, < 2.0.0.383
WSO2WSO2 API Manager< 3.0.0; >= 3.0.0, < 3.0.0.160; >= 3.1.0, < 3.1.0.335; >= 3.2.0, < 3.2.0.432; >= 3.2.1, < 3.2.1.51; >= 4.0.0, < 4.0.0.310; >= 4.1.0, < 4.1.0.208; >= 4.2.0, < 4.2.0.146; >= 4.3.0, < 4.3.0.59
WSO2WSO2 Identity Server as Key Manager< 5.9.0; >= 5.9.0, < 5.9.0.163; >= 5.10.0, < 5.10.0.355
WSO2WSO2 Open Banking IAM< 2.0.0; >= 2.0.0, < 2.0.0.404
WSO2WSO2 Enterprise Integrator< 6.6.0; >= 6.6.0, < 6.6.0.212
WSO2WSO2 Identity Server< 5.9.0; >= 5.9.0, < 5.9.0.154; >= 5.10.0, < 5.10.0.291; >= 5.11.0, < 5.11.0.371; >= 6.0.0, < 6.0.0.178; >= 6.1.0, < 6.1.0.134
WSO2WSO2 Carbon Registry Kernel>= 4.5.1, < 4.5.1.36; >= 4.5.3, < 4.5.3.36; >= 4.6.0, < 4.6.0.139; >= 4.6.0, < 4.6.0.1544; >= 4.6.1, < 4.6.1.105; >= 4.6.2, < 4.6.2.321; >= 4.6.3, < 4.6.3.28; >= 4.6.4, < 4.6.4.11; >= 4.7.1, < 4.7.1.47; >= 4.8.1, < 4.8.1.27; >= 4.8.1, < 4.8.1.31; >= 4.9.0, < 4.9.0.46; >= 4.9.26, < 4.9.26.18

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2024-2372?
The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.
How severe is CVE-2024-2372?
CVE-2024-2372 has a CVSS score of 5.4/10 (MEDIUM severity).
How do I fix CVE-2024-2372?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2024

View all 2024CVEs →

Are you affected by CVE-2024-2372?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST