Skip to content
OpenAdvisories
Low · 2.7 CVE-2024-4412 EUVD-2024-55807GHSA-f6jh-7mqr-5h2p

Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations

Published Oct 19, 2026 · Updated Oct 20, 2026 · Assigned by WSO2

Vendor: WSO2 Product: WSO2 API Manager Product: WSO2 Carbon Identity Application Authentication Framework Product: WSO2 Carbon Identity Recovery Management Product: WSO2 Carbon Identity User Store Product: WSO2 Carbon Identity User Store Configuration Product: WSO2 Carbon Identity User Store Configuration UI Product: WSO2 Enterprise Integrator Product: WSO2 Identity Server Product: WSO2 Identity Server as Key Manager Product: WSO2 Open Banking AM Product: WSO2 Open Banking IAM

Description

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment.

Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.

Affected products

VendorProductAffectedFixed
WSO2 WSO2 Enterprise Integrator 6.6.0 – < 6.6.0.205 6.6.0.205
WSO2 WSO2 API Manager 3.1.0 – < 3.1.0.276, 3.2.0 – < 3.2.0.366, 3.2.1 – < 3.2.1.18, 4.0.0 – < 4.0.0.307, 4.1.0 – < 4.1.0.169, 4.2.0 – < 4.2.0.108, 4.3.0 – < 4.3.0.20 3.1.0.276
WSO2 WSO2 Open Banking IAM 2.0.0 – < 2.0.0.346 2.0.0.346
WSO2 WSO2 Identity Server 5.10.0 – < 5.10.0.297, 5.11.0 – < 5.11.0.337, 6.0.0 – < 6.0.0.189, 6.1.0 – < 6.1.0.149, 7.0.0 – < 7.0.0.15 5.10.0.297
WSO2 WSO2 Identity Server as Key Manager 5.10.0 – < 5.10.0.293 5.10.0.293
WSO2 WSO2 Open Banking AM 2.0.0 – < 2.0.0.326 2.0.0.326
WSO2 WSO2 Carbon Identity User Store Configuration UI 5.14.127 – < 5.14.127.8, 5.17.5 – < 5.17.5.266, 5.17.118 – < 5.17.118.6, 5.18.187 – < 5.18.187.253, 5.18.248 – < 5.18.248.20, 5.23.8 – < 5.23.8.178, 5.24.8 – < 5.24.8.9, 5.25.92 – < 5.25.92.81, 5.25.705 – < 5.25.705.8, 7.0.78 – < 7.0.78.12 5.14.127.8
WSO2 WSO2 Carbon Identity User Store Configuration 5.14.127 – < 5.14.127.8, 5.17.5 – < 5.17.5.266, 5.17.118 – < 5.17.118.6, 5.18.187 – < 5.18.187.253, 5.18.248 – < 5.18.248.20, 5.23.8 – < 5.23.8.178, 5.24.8 – < 5.24.8.9, 5.25.92 – < 5.25.92.81, 5.25.705 – < 5.25.705.8, 7.0.78 – < 7.0.78.12 5.14.127.8
WSO2 WSO2 Carbon Identity Recovery Management 1.4.72 – < 1.4.72.66, 1.4.100 – < 1.4.100.6, 1.7.2 – < 1.7.2.2, 1.8.107 – < 1.8.107.1 1.4.72.66
WSO2 WSO2 Carbon Identity Application Authentication Framework 5.18.248 – < 5.18.248.20, 5.24.8 – < 5.24.8.9, 5.25.705 – < 5.25.705.8 5.18.248.20
WSO2 WSO2 Carbon Identity User Store 1.0.190 – < 1.0.190.14, 1.2.3 – < 1.2.3.4, 1.2.23 – < 1.2.23.4 1.0.190.14

References