QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2024-10242

Back to search

CVE-2024-10242

Published: Apr 16, 2026

Modified: Apr 16, 2026

PUBLISHED

CVSS v3.1

6.1

MEDIUM

Description

The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to inject malicious script payloads into the input parameters, which are then executed by the victim's browser. Successful exploitation can enable an attacker to redirect the user's browser to a malicious website, modify the UI of the web page, or retrieve information from the browser. However, the impact is limited as session-related sensitive cookies are protected by the httpOnly flag, preventing session hijacking.

VendorProductVersions

WSO2

WSO2 API Manager

unknown
0 - < 3.2.0
affected
3.2.0 - < 3.2.0.401
affected
4.0.0 - < 4.0.0.318

Weaknesses (CWE)

CWE-79

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now