CVE-2024-6429

Published: Sep 23, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8 (Secondary)

Description

A content spoofing vulnerability exists in multiple WSO2 products due to improper error message handling. Under certain conditions, error messages are passed through URL parameters without validation, allowing malicious actors to inject arbitrary content into the UI. By exploiting this vulnerability, attackers can manipulate browser-displayed error messages, enabling social engineering attacks through deceptive or misleading content.

Affected (12)

Products: Wso2: Api Manager, Identity Server

Wso2

2 products

Api Manager

Identity Server

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Wso2 Api Manager	Version 3.2.0
Wso2 Api Manager	Version 3.2.1
Wso2 Api Manager	Version 4.0.0
Wso2 Api Manager	Version 4.1.0
Wso2 Api Manager	Version 4.2.0
Wso2 Api Manager	Version 4.3.0
Wso2 Api Manager	Version 4.4.0
Wso2 Identity Server	Version 5.10.0
Wso2 Identity Server	Version 5.11.0
Wso2 Identity Server	Version 6.0.0
Wso2 Identity Server	Version 6.1.0
Wso2 Identity Server	Version 7.0.0

Related CWEs

CWE-451

User Interface (UI) Misrepresentation of Critical Information

The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.

References (1)

https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2025/WSO2-2024-3490/

Source: ed10eef1-636d-4fbe-9993-6890dfa878f8

Vendor Advisory

Timeline

No history available yet.