CVE-2024-6429
Last modified
CVE-2024-6429 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wso2 | Api Manager | 3.2.0 |
| Wso2 | Api Manager | 3.2.1 |
| Wso2 | Api Manager | 4.0.0 |
| Wso2 | Api Manager | 4.1.0 |
| Wso2 | Api Manager | 4.2.0 |
| Wso2 | Api Manager | 4.3.0 |
| Wso2 | Api Manager | 4.4.0 |
| Wso2 | Identity Server | 5.10.0 |
| Wso2 | Identity Server | 5.11.0 |
| Wso2 | Identity Server | 6.0.0 |
| Wso2 | Identity Server | 6.1.0 |
| Wso2 | Identity Server | 7.0.0 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-6429?
How severe is CVE-2024-6429?
How do I fix CVE-2024-6429?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-6422An unauthenticated remote attacker can manipulate the device…9.8
- CVE-2024-6424External server-side request vulnerability in MESbook 202210…8.2
- CVE-2024-6425Incorrect Provision of Specified Functionality vulnerability…9.1
- CVE-2024-6426Information exposure vulnerability in MESbook 20221021.03 ve…7.1
- CVE-2024-6427Uncontrolled Resource Consumption vulnerability in MESbook 2…7.5
- CVE-2024-6428Mattermost versions 9.8.0, 9.7.x <= 9.7.4, 9.6.x <= 9.6.2, 9…6.5
- CVE-2024-6431The Media.net Ads Manager plugin for WordPress is vulnerable…8.8
- CVE-2024-6432The Content Blocks (Custom Post Widget) plugin for WordPress…5.4
- CVE-2024-6433The application zips all the files in the folder specified b…7.5
- CVE-2024-6434The Premium Addons for Elementor plugin for WordPress is vul…4.3
- CVE-2024-6435A privilege escalation vulnerability exists in the affected …8.8
- CVE-2024-6436An input validation vulnerability exists in the Rockwell Aut…6.5
Are you affected by CVE-2024-6429?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST