CVE-2024-6541 json
Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products
published 2026-08-06 3 mo ago modified 2026-10-27 12 d ago also EUVD-2024-55712
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 27%
- public exploits
- 0
- none known
Summary
The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated.
This weakness can lead to the disclosure of sensitive information belonging to other users or the unintended modification of system data by authenticated users. The exact impact depends on how `messageContext` properties are utilized within the affected WSO2 products.
Patch / fix
- WSO2 WSO2 Micro Integrator 1.2.0.163, 4.1.0.103, 4.3.0.7
- WSO2 WSO2 Enterprise Integrator 6.6.0.205
- WSO2 WSO2 API Manager 3.2.0.394, 3.2.1.21, 4.0.0.311, 4.1.0.167, 4.2.0.110, 4.3.0.24
- WSO2 WSO2-Synapse 2.1.7.wso2v143_119, 2.1.7.wso2v182_93, 2.1.7.wso2v183_62, 2.1.7.wso2v227_88, 2.1.7.wso2v271_60, 2.1.7.wso2v319_7, 4.0.0.wso2v20_63, 4.0.0.wso2v105_3, 4.0.0.wso2v119_3, v4.0.0-wso2v121
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 3 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
- WSO2 WSO2 Micro Integrator
- WSO2 WSO2 Enterprise Integrator
- WSO2 WSO2 API Manager
- WSO2 WSO2-Synapse
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
Sources
- CVE List CVE-2024-6541
- NVD CVE-2024-6541
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.