CVE-2024-4412
Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations
CVSS Score
2.7
EPSS Score
0.0%
EPSS Percentile
0th
The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerability requires administrator privileges. The impact is minimal as EL usage is restricted to certain read operations.
| CWE | CWE-94 |
| Vendor | wso2 |
| Product | wso2 enterprise integrator |
| Published | Oct 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for wso2 wso2 enterprise integrator
Be the first to know when new low vulnerabilities affecting wso2 wso2 enterprise integrator are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
WSO2 / WSO2 Enterprise Integrator
6.6.0 < 6.6.0.205
WSO2 / WSO2 API Manager
3.1.0 < 3.1.0.276 3.2.0 < 3.2.0.366 3.2.1 < 3.2.1.18 4.0.0 < 4.0.0.307 4.1.0 < 4.1.0.169 4.2.0 < 4.2.0.108 4.3.0 < 4.3.0.20
WSO2 / WSO2 Open Banking IAM
2.0.0 < 2.0.0.346
WSO2 / WSO2 Identity Server
5.10.0 < 5.10.0.297 5.11.0 < 5.11.0.337 6.0.0 < 6.0.0.189 6.1.0 < 6.1.0.149 7.0.0 < 7.0.0.15
WSO2 / WSO2 Identity Server as Key Manager
5.10.0 < 5.10.0.293
WSO2 / WSO2 Open Banking AM
2.0.0 < 2.0.0.326
WSO2 / WSO2 Carbon Identity User Store Configuration UI
5.14.127 < 5.14.127.8 5.17.5 < 5.17.5.266 5.17.118 < 5.17.118.6 5.18.187 < 5.18.187.253 5.18.248 < 5.18.248.20 5.23.8 < 5.23.8.178 5.24.8 < 5.24.8.9 5.25.92 < 5.25.92.81 5.25.705 < 5.25.705.8 7.0.78 < 7.0.78.12
WSO2 / WSO2 Carbon Identity User Store Configuration
5.14.127 < 5.14.127.8 5.17.5 < 5.17.5.266 5.17.118 < 5.17.118.6 5.18.187 < 5.18.187.253 5.18.248 < 5.18.248.20 5.23.8 < 5.23.8.178 5.24.8 < 5.24.8.9 5.25.92 < 5.25.92.81 5.25.705 < 5.25.705.8 7.0.78 < 7.0.78.12
WSO2 / WSO2 Carbon Identity Recovery Management
1.4.72 < 1.4.72.66 1.4.100 < 1.4.100.6 1.7.2 < 1.7.2.2 1.8.107 < 1.8.107.1
WSO2 / WSO2 Carbon Identity Application Authentication Framework
5.18.248 < 5.18.248.20 5.24.8 < 5.24.8.9 5.25.705 < 5.25.705.8
WSO2 / WSO2 Carbon Identity User Store
1.0.190 < 1.0.190.14 1.2.3 < 1.2.3.4 1.2.23 < 1.2.23.4
References
security.docs.wso2.com: https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2023-3098/ github.com: https://github.com/wso2-extensions/identity-governance/pull/848 github.com: https://github.com/wso2/carbon-identity-framework/pull/5895 github.com: https://github.com/wso2/identity-apps/pull/6829 github.com: https://github.com/wso2/product-apim/pull/13524