2 lines
6.4 KiB
JSON
2 lines
6.4 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"WSO2 Open Banking AM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.383","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 API Manager","vendor":"WSO2","versions":[{"lessThan":"3.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"3.0.0.160","status":"affected","version":"3.0.0","versionType":"custom"},{"lessThan":"3.1.0.335","status":"affected","version":"3.1.0","versionType":"custom"},{"lessThan":"3.2.0.432","status":"affected","version":"3.2.0","versionType":"custom"},{"lessThan":"3.2.1.51","status":"affected","version":"3.2.1","versionType":"custom"},{"lessThan":"4.0.0.310","status":"affected","version":"4.0.0","versionType":"custom"},{"lessThan":"4.1.0.208","status":"affected","version":"4.1.0","versionType":"custom"},{"lessThan":"4.2.0.146","status":"affected","version":"4.2.0","versionType":"custom"},{"lessThan":"4.3.0.59","status":"affected","version":"4.3.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server as Key Manager","vendor":"WSO2","versions":[{"lessThan":"5.9.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.9.0.163","status":"affected","version":"5.9.0","versionType":"custom"},{"lessThan":"5.10.0.355","status":"affected","version":"5.10.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Open Banking IAM","vendor":"WSO2","versions":[{"lessThan":"2.0.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"2.0.0.404","status":"affected","version":"2.0.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Enterprise Integrator","vendor":"WSO2","versions":[{"lessThan":"6.6.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"6.6.0.212","status":"affected","version":"6.6.0","versionType":"custom"}]},{"defaultStatus":"unaffected","product":"WSO2 Identity Server","vendor":"WSO2","versions":[{"lessThan":"5.9.0","status":"unknown","version":"0","versionType":"custom"},{"lessThan":"5.9.0.154","status":"affected","version":"5.9.0","versionType":"custom"},{"lessThan":"5.10.0.291","status":"affected","version":"5.10.0","versionType":"custom"},{"lessThan":"5.11.0.371","status":"affected","version":"5.11.0","versionType":"custom"},{"lessThan":"6.0.0.178","status":"affected","version":"6.0.0","versionType":"custom"},{"lessThan":"6.1.0.134","status":"affected","version":"6.1.0","versionType":"custom"}]},{"defaultStatus":"unknown","packageName":"org.wso2.carbon:org.wso2.carbon.registry.core","product":"WSO2 Carbon Registry Kernel","vendor":"WSO2","versions":[{"lessThan":"4.5.1.36","status":"affected","version":"4.5.1","versionType":"custom"},{"lessThan":"4.5.3.36","status":"affected","version":"4.5.3","versionType":"custom"},{"lessThan":"4.6.0.139","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.0.1544","status":"affected","version":"4.6.0","versionType":"custom"},{"lessThan":"4.6.1.105","status":"affected","version":"4.6.1","versionType":"custom"},{"lessThan":"4.6.2.321","status":"affected","version":"4.6.2","versionType":"custom"},{"lessThan":"4.6.3.28","status":"affected","version":"4.6.3","versionType":"custom"},{"lessThan":"4.6.4.11","status":"affected","version":"4.6.4","versionType":"custom"},{"lessThan":"4.7.1.47","status":"affected","version":"4.7.1","versionType":"custom"},{"lessThan":"4.8.1.27","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.8.1.31","status":"affected","version":"4.8.1","versionType":"custom"},{"lessThan":"4.9.0.46","status":"affected","version":"4.9.0","versionType":"custom"},{"lessThan":"4.9.26.18","status":"affected","version":"4.9.26","versionType":"custom"}]}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain.\n\nBy leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm."},{"lang":"es","value":"Los componentes afectados aceptan entradas proporcionadas por el usuario para construir URL de redirección sin aplicar las restricciones de validación esperadas. Esto permite a un atacante proporcionar una URL manipulada que puede redirigir a los usuarios a un dominio externo arbitrario.\n\nAl aprovechar esta vulnerabilidad de redirección abierta, un atacante puede crear un enlace malicioso que, al ser pulsado por un usuario, los redirige a una página controlada por el atacante. Esto puede utilizarse en combinación con técnicas de ingeniería social para ejecutar ataques de phishing, con el objetivo de obtener información sensible o causar otros daños."}],"id":"CVE-2024-2372","lastModified":"2026-11-09T10:10:00.217","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-2372","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-02T16:56:50.364469Z","version":"2.0.3"}}]},"published":"2026-11-02T11:17:28.460","references":[{"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","url":"https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2026/WSO2-2024-3254/"}],"sourceIdentifier":"ed10eef1-636d-4fbe-9993-6890dfa878f8","vulnStatus":"Awaiting Analysis","weaknesses":[{"description":[{"lang":"en","value":"CWE-601"}],"source":"ed10eef1-636d-4fbe-9993-6890dfa878f8","type":"Secondary"}]}
|