CVE-2024-4598

Published: Sep 23, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Description

An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions. This vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.

Affected (6)

Products: Wso2: Api Manager, Micro Integrator

Wso2

2 products

Api Manager

Micro Integrator

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Manager	From 3.2.0 to 3.2.0.422
Wso2 Api Manager	From 3.2.1 to 3.2.1.42
Wso2 Api Manager	From 4.1.0 to 4.1.0.152
Wso2 Api Manager	From 4.3.0 to 4.3.0.55
Wso2 Micro Integrator	From 1.2.0 to 1.2.0.157
Wso2 Micro Integrator	From 4.1.0 to 4.1.0.95

Related CWEs

CWE-1259

Improper Restriction of Security Token Assignment

The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

References (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3355/

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

Vendor Advisory

Timeline

No history available yet.