CVEvulnerability

CVE-2024-4598

6.5 MEDIUM Published 2025-09-23 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2025-09-23
Last modified
2026-06-17
Assigner
ed10eef1-636d-4fbe-9993-6890dfa878f8
CVSS 3.1 (ed10eef1-636d-4fbe-9993-6890dfa878f8)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1259

Description

An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticated users may be able to view unintended business data from other mediation contexts because the internal state is not properly isolated or cleared between executions. This vulnerability does not impact user credentials or access tokens but may lead to leakage of sensitive business information handled during message flows.

Affected configurations

• wso2 api manager (>= 3.2.0 < 3.2.0.422) • wso2 api manager (>= 3.2.1 < 3.2.1.42) • wso2 api manager (>= 4.1.0 < 4.1.0.152) • wso2 api manager (>= 4.3.0 < 4.3.0.55) • wso2 micro integrator (>= 1.2.0 < 1.2.0.157) • wso2 micro integrator (>= 4.1.0 < 4.1.0.95)

Related

Weakness · CWE (1)

  • CWE-1259 Improper Restriction of Security Token Assignment weakness

References