nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-10302 CVE-2024-10302
MEDIUM
Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
Record summary
CVE-2024-10302 has a selected CVSS score of 4.0 (medium).
Description
The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 6, 2026 · Source: CVE List
Affected products and versions
8| Product | Source | Version range | Status |
|---|---|---|---|
WSO2 API Control PlaneBrowse WSO2 / WSO2 API Control PlaneDefault status: unaffected | CVE List | 4.5.0 to < 4.5.0.10 | affected |
WSO2 API ManagerBrowse WSO2 / WSO2 API ManagerDefault status: unaffected | CVE List | Before 3.1.0 | unknown |
| 3.1.0 to < 3.1.0.331 | affected | ||
| 3.2.0 to < 3.2.0.427 | affected | ||
| 3.2.1 to < 3.2.1.39 | affected | ||
| 4.0.0 to < 4.0.0.318 | affected | ||
| 4.1.0 to < 4.1.0.200 | affected | ||
| 4.2.0 to < 4.2.0.138 | affected | ||
| 4.3.0 to < 4.3.0.51 | affected | ||
| 4.5.0 to < 4.5.0.9 | affected | ||
WSO2 Carbon Identity Recovery ManagementBrowse WSO2 / WSO2 Carbon Identity Recovery Managementorg.wso2.carbon.identity.governance:org.wso2.carbon.identity.recoveryDefault status: unknown | CVE List | 1.4.1 to < 1.4.1.72 | affected |
| 1.4.72 to < 1.4.72.68 | affected | ||
| 1.4.100 to < 1.4.100.8 | affected | ||
| 1.4.102 to < 1.4.102.2 | affected | ||
| 1.7.2 to < 1.7.2.4 | affected | ||
| 1.8.107 to < 1.8.107.2 | affected | ||
| 1.8.108 to < 1.8.108.4 | affected | ||
| 1.6.380 to ≤ 1.6.* | unaffected | ||
| 1.8.109 to ≤ * | unaffected | ||
WSO2 Identity ServerBrowse WSO2 / WSO2 Identity ServerDefault status: unaffected | CVE List | Before 5.10.0 | unknown |
| 5.10.0 to < 5.10.0.358 | affected | ||
| 5.11.0 to < 5.11.0.379 | affected | ||
WSO2 Identity Server as Key ManagerBrowse WSO2 / WSO2 Identity Server as Key ManagerDefault status: unaffected | CVE List | Before 5.10.0 | unknown |
| 5.10.0 to < 5.10.0.351 | affected | ||
WSO2 Open Banking IAMBrowse WSO2 / WSO2 Open Banking IAMDefault status: unaffected | CVE List | Before 2.0.0 | unknown |
| 2.0.0 to < 2.0.0.400 | affected | ||
WSO2 Traffic ManagerBrowse WSO2 / WSO2 Traffic ManagerDefault status: unaffected | CVE List | 4.5.0 to < 4.5.0.9 | affected |
WSO2 Universal GatewayBrowse WSO2 / WSO2 Universal GatewayDefault status: unaffected | CVE List | 4.5.0 to < 4.5.0.9 | affected |
References
2security.docs.wso2.comVendor advisory
https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3740