CVE-2024-6423 — MEDIUM (4.0)

Vulnerability Description

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging. If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

CVSS Score

4.0

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-20

References

https://security.docs.wso2.com/en/latest/security-announcements/security-advisor

FAQ

What is CVE-2024-6423?

CVE-2024-6423 is a vulnerability with a CVSS score of 4.0 (MEDIUM). The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the pro...

How severe is CVE-2024-6423?

CVE-2024-6423 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-6423?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.