« Volver al listado

CVE-2024-4867

Estado: AnalizadaMedia (5.4)—

The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser.

By leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wso2 — API Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4867",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4867",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-16T12:20:00.908233Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "affectedData": [
        {
          "vendor": "WSO2",
          "product": "WSO2 API Manager",
          "versions": [
            {
              "status": "unknown",
              "version": "0",
              "lessThan": "3.2.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.2.0",
              "lessThan": "3.2.0.408",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "3.2.1",
              "lessThan": "3.2.1.32",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.0.0",
              "lessThan": "4.0.0.293",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "lessThan": "4.1.0.187",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-16T10:16:13.893",
  "references": [
    {
      "url": "https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3391/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ed10eef1-636d-4fbe-9993-6890dfa878f8",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This deficiency allows a malicious actor to inject script content that is executed within the context of a user's browser.\n\nBy leveraging this cross-site scripting vulnerability, a malicious actor can cause the browser to redirect to a malicious website, make changes to the UI of the web page, or retrieve information from the browser. However, session hijacking is not possible as all session-related sensitive cookies are protected by the httpOnly flag."
    }
  ],
  "lastModified": "2026-06-17T08:03:04.153",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B00223A-8102-4887-A1A0-77B70ADDFFF5",
              "versionEndExcluding": "3.2.0.408",
              "versionStartIncluding": "3.2.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A2CEF3D6-6A12-4933-8CAE-47870AC52DE7",
              "versionEndExcluding": "3.2.1.32",
              "versionStartIncluding": "3.2.1"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45192132-C0AD-4E30-B2C0-864217FF1DCD",
              "versionEndExcluding": "4.0.0.293",
              "versionStartIncluding": "4.0.0"
            },
            {
              "criteria": "cpe:2.3:a:wso2:api_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD911958-DA13-4B7C-8657-9ABE655352AF",
              "versionEndExcluding": "4.1.0.187",
              "versionStartIncluding": "4.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ed10eef1-636d-4fbe-9993-6890dfa878f8"
}