CVE-2024-6423

Published: Ott 21, 2026 Last Modified: Ott 21, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 4,0
Source: ed10eef1-636d-4fbe-9993-6890dfa878f8
Attack Vector: local
Attack Complexity: high
Privileges Required: high
User Interaction: required
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data to be passed to flows where it was not intended to be processed. Although the product did not utilize this data, its acceptance could lead to logging.

If a user mistakenly sends sensitive data via URL parameters to any flow, this data could be inadvertently logged in access logs. This has the potential to expose confidential information, compromising the security and privacy of affected systems if the product is used incorrectly.

20

Improper Input Validation

Stable
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Confidentiality Integrity
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Read Memory Read Files Or Directories Modify Memory Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML
Likelihood of Exploit: High
View CWE Details
https://security.docs.wso2.com/en/latest/security-announcem…
https://security.docs.wso2.com/en/latest/security-announcements/security-adviso…